Victoria’s Secret’s US e-commerce site and related systems went dark on May 28–29, 2025 following what the company called a “security incident”. The precise cause has not been confirmed, but news reports treat it as a likely cyberattack or data breach. For example, security researchers noted indicators consistent with the notorious “Scattered Spider” retail-extortion group (which recently hit other retailers). In one Wednesday update the company even acknowledged that a breach had occurred, though it gave no technical details. In sum, Victoria’s Secret has only said that it identified an ongoing security incident; independent analysis suggests a targeted cyber intrusion in line with recent retailer hacks.
Current Operational Status
Victoria’s Secret retail store. All brick-and-mortar VS and PINK stores remain open even as the US website is shut down. The company’s homepage now shows a full-page notice: “Valued customer, we identified and are taking steps to address a security incident. We have taken down our website and some in-store services as a precaution… Our team is working around the clock to fully restore operations”. This message (on a pink background) is the only thing online shoppers see. Customer-support channels (chat, email and phone) are also offline. By contrast, VS emphasizes that its physical stores (including PINK) “remain open”, so in-person shopping can continue. (Victoria’s Secret noted that its UK site is unaffected, implying the breach is localized to its US systems)
The outage affects a large business: Victoria’s Secret operates ~1,380 stores worldwide (annual revenue ~$6.2 billion). Online sales are critical (roughly $2 billion of revenue in 2024, about one-third of total sales). As of the latest reports on May 29, the website is still offline, and the company has given no firm date for restoration.
Impact on Operations, Employees, and Customers
- Online Orders & Logistics: E-commerce is effectively paused. VS says it is working to fulfill all orders placed before Monday, May 26, and will email customers with tracking once shipments go out. To compensate, the company extended its U.S. return window by 30 days and has reactivated coupons that expired during the outage. (However, customers cannot yet return online purchases in person, that functionality is “paused” and will be restored later.)
- Customer Service: All digital support lines are down. Customers have taken to social media to voice frustration. For example, one X/Twitter user complained: “How can I check my order status when your page has been down for 2 days?!? … You haven’t released any statements giving information about how long this will take.”. Retail Dive similarly noted Instagram comments saying the site outage began four days ago, during an ongoing sale, leaving shoppers “at your mercy” without answers.
- Employees and Internal Ops: Internally, Victoria’s Secret has felt the impact. Reports indicate the company shut down some office systems mid-week: some employees were locked out of company email and certain corporate services were halted as the breach was investigated. Management warned staff that recovery will be lengthy (see below).
- Business Metrics: The stock market reacted to the news: Victoria’s Secret shares dropped about 4–7% when the incident became public. That reflects investor concern over lost sales, remediation costs, and potential data liabilities.
Company and Leadership Statements
Victoria’s Secret has released only limited public statements. The on-site notice (quoted above) thanks customers for their patience and reminds them that “our Victoria’s Secret and PINK stores remain open”. In interviews, a company spokesperson confirmed the gist of the notice. CBS News (AP) quoted a VS spokesperson: “We immediately enacted our response protocols, third-party experts are engaged, and we took down our website and some in-store services as a precaution. We are working to quickly and securely restore operations.”. The company has not said whether law enforcement (e.g. FBI) is involved.
At the executive level, CEO Hillary Super (appointed Sept 2024) privately told employees that “recovery is going to take awhile”. In other words, Victoria’s Secret is braced for a multi-week outage. Official investor FAQs echo that uncertainty: VS notes there is no specific timeline for the website’s return. In summary, leadership says it is working 24/7 on the problem, but customers should not expect an immediate fix.
Media Coverage and Expert Analysis
National media and security experts have been covering the incident closely. CNN, BBC, and others highlighted how unusual this is for a major retailer. CNN pointed out that a retailer of VS’s size rarely sees a prolonged site outage, especially since online sales are so important (about $2B in 2024). The story was picked up by CNN, NBC, and BBC as a top tech/security news item.
Cybersecurity analysts place the VS incident in a broader context. Several British retailers (Marks & Spencer, Co-op) suffered coordinated hacks in recent weeks, and authorities suspect the Scattered Spider ransomware crew is behind those attacks. Security publication SC Media reported that VS “shut down its website following [an] unspecified cyberattack,” and quoted experts noting signs “consistent with Scattered Spider’s playbook”. An AI-security CEO told CNN that “hackers are ahead of the game” and warned retailers often outsource security, making them vulnerable. McAfee and other online-protection firms have advised customers to assume their data might be at risk and to change passwords and enable 2FA as a precaution.
So far, VS has not announced any ransom demand or data breach notification. But experts stress that full resolution could take weeks or months (for instance, Marks & Spencer’s recent hack was said to affect operations into July). Victoria’s Secret’s CEO herself warned employees to expect a drawn-out recovery, underscoring that analysts see this as a major incident, not a short glitch.
Timeline and Outlook
The timeline of events has been roughly as follows:
- May 26 (Monday): Customers first report issues accessing the Victoria’s Secret site.
- May 28 (Wednesday): Company confirms the incident on its site and social media (Wednesday news articles cite the outage). Shares tumble when the news breaks.
- May 29 (Thursday): Online site remains down. Victoria’s Secret extends return/coupon deadlines and issues updates (e.g. via FAQs). CEO Super’s memo (“recovery will take a while”) is reported by Bloomberg. Analysts note the site has been offline since at least Monday.
As of May 29, there is no announced fix date. Victoria’s Secret says its team is “working around the clock” to restore service, but customers should prepare for an extended outage. Most experts advise that remediation (forensics, system rebuild, data recovery) will take many weeks. Meanwhile, VS is operating with backup plans in stores and continuing to update affected customers.
Sources: Reporting by CNN, BBC, AP/CBS, Security Boulevard, BleepingComputer, Entrepreneur, and others. All details are accurate as of May 29, 2025.
