September Spotlight Breach: How Social Engineering Opened the Door at Levi Strauss

What Happened? 

In August 2026, Levi Strauss & Co. disclosed a cyber security incident after an unauthorised third party used social engineering techniques to gain access to three employees’ company-issued computers. 

Once the attackers gained access, they were able to get into company files and steal corporate information. Levi Strauss hasn’t shared exactly what was taken or how the employees were persuaded to give the attackers access, so there are still some unanswered questions around how the attack unfolded. 

What we do know is that Levi Strauss spotted the activity and acted quickly. The company was able to shut down the unauthorised access, and its initial investigation found no evidence that consumer data had been compromised. The incident didn’t disrupt day-to-day operations either, which suggests the response helped contain the attack before it could cause wider damage. 

The investigation is still ongoing, but the incident shows just how effective social engineering can be. Attackers don’t necessarily need to find a weakness in your technology if they can persuade someone inside the organisation to let them in. 

Why Social Engineering Remains So Effective 

Organisations have spent years investing in technology to make it harder for attackers to get into their systems. But when the front door is well protected, cyber criminals look for another route, and increasingly, that means targeting the people with legitimate access. 

We don’t know exactly how the three Levi Strauss employees were approached, or what persuaded them to give the attackers access, what we do know is that it worked. Just three employees were targeted, yet the attackers were able to access company-issued computers and steal corporate information. 

That’s what makes social engineering so difficult to defend against. Attackers do their homework, using information about an organisation or its employees to make a request feel genuine. Something that appears to come from IT support, for example, can seem perfectly reasonable when it lands in the middle of a busy working day. 

Employees therefore need to be prepared for those moments. They need to feel comfortable slowing down when something seems unusual, checking that a request is genuine and reporting it quickly if something doesn’t feel right. Technical controls still matter, but giving people the confidence to question what they’re being asked to do can stop a convincing approach from becoming a much bigger security incident. 

Three Employees Were Enough to Create a Security Incident 

One of the most striking details about the Levi Strauss breach is its scale at the point of entry. The attack targeted just three employees, yet that was enough for an unauthorised third party to access company-issued computers and take corporate information. 

It’s a good example of why human cyber risk can’t be measured simply by looking at how many employees have clicked a phishing simulation or completed their annual training. A single successful social engineering attempt can create an opportunity for an attacker, particularly if the employee or device involved has access to sensitive information. 

That doesn’t mean employees should be treated as the problem. Cyber criminals deliberately design social engineering attacks to exploit normal human behaviour, whether that’s trusting a convincing request or trying to resolve something quickly. 

The goal of security awareness should be to prepare people for those moments. Employees need practical experience of the techniques attackers use and the confidence to stop, question a request and report it when something doesn’t seem right. 

What Levi Strauss Did Well 

The attackers may have succeeded in getting hold of corporate information, but Levi Strauss appears to have acted quickly once the activity was discovered. 

The company put its incident response plan into action and brought in external cyber security experts to help investigate what had happened. Most importantly, it was able to shut down the unauthorised access and stop the attackers from getting any further. 

That quick response seems to have made a real difference. Levi Strauss said its initial investigation found no evidence that consumer data had been compromised, and the incident didn’t disrupt its day-to-day business operations. 

It’s an important part of the story because no organisation can assume it will stop every attack at the first hurdle. Sometimes attackers will get through, and when they do, how quickly you spot what’s happening and respond can have a huge impact on what happens next. Having a plan in place means teams aren’t figuring things out for the first time while an incident is already unfolding. 

What Organisations Can Learn 

The Levi Strauss breach is a good example of why social engineering can’t be treated as a topic employees hear about once a year and then forget. Attackers are constantly changing their approach, and the situations they create can look remarkably similar to the genuine requests people deal with every day. 

Security awareness needs to keep pace with that. Rather than simply telling employees to “watch out for suspicious messages”, organisations can give people opportunities to experience realistic scenarios and practise how they would respond. The more familiar those tactics feel, the easier it becomes to recognise when something isn’t quite right. 

Creating a culture where people feel comfortable questioning unusual requests matters too. If an employee receives an unexpected call asking for access, for example, they should know how to check whether it’s genuine without feeling they’re being difficult or holding someone up. And if they do suspect something is wrong, reporting it should be quick and easy. 

There’s also a lesson in what happened after the attackers got in. Levi Strauss was able to contain the incident before it disrupted operations or, based on its initial investigation, affected consumer data. Organisations need to think about that side of the equation too, making sure suspicious activity can be spotted quickly and everyone involved knows what to do when an incident occurs. 

Ultimately, social engineering works because attackers know how to make their requests feel believable. We can’t remove that human instinct to trust altogether, nor would we want to. But we can give employees the knowledge and confidence to recognise when a request deserves a second look, making it much harder for one convincing interaction to turn into something more serious. 

Prepare Your Employees for Social Engineering Attacks 

The most effective social engineering attacks don’t necessarily look suspicious at first glance. They can arrive as a perfectly plausible request from someone who seems to have a good reason for asking, which is exactly why employees need the opportunity to practise recognising them. 

MetaCompliance helps organisations prepare employees for those moments through engaging security awareness training that helps people understand how social engineering works and recognise the tactics attackers use. Our advanced phishing simulations  give employees the opportunity to put that knowledge into practice with realistic scenarios based on the threats they’re likely to encounter. If someone does fall for a simulation, relevant follow-up training can help address the specific behaviour and reinforce what to look out for next time. 

By combining regular awareness with practical experience, organisations can help employees become more confident questioning unusual requests and responding quickly when something doesn’t feel right. 

Get in touch to find out how MetaCompliance can help your employees stay one step ahead of social engineering attacks, or book a demo today.