--- title: Hackers talked their way into Levi’s, and three... description: Levi Strauss disclosed a cybersecurity breach in an SEC filing after attackers used social engineering — not software exploits — to access three employees'... canonical: https://daily.dev/posts/hackers-talked-their-way-into-levi-s-and-three-computers-were-enough-xrlx6bcys twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers talked their way into Levi’s, and three computers were enough | daily.dev og:description: Levi Strauss disclosed a cybersecurity breach in an SEC filing after attackers used social engineering — not software exploits — to access three employees'... og:url: https://daily.dev/posts/hackers-talked-their-way-into-levi-s-and-three-computers-were-enough-xrlx6bcys og:image: https://api.daily.dev/og/posts/XRlX6BcyS.png og:image:alt: Hackers talked their way into Levi’s, and three computers were enough og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers talked their way into Levi’s, and three computers were enough **[The Next Web](https://daily.dev/sources/tnw)** · 3 min read · 0 upvotes · 0 comments ## Summary Levi Strauss disclosed a cybersecurity breach in an SEC filing after attackers used social engineering — not software exploits — to access three employees' computers and exfiltrate corporate data. No consumer data was affected and operations continued uninterrupted. The incident fits into a broader wave of over 200 companies targeted in five weeks by crews tracked by Google under the umbrella designation UNC6671, who phone employees posing as colleagues or IT support, then direct them to spoofed login pages that harvest both passwords and one-time MFA codes simultaneously. Attribution for the Levi's breach specifically has not been confirmed. The attack highlights how MFA becomes ineffective against real-time phishing, and how social engineering can reach even production-level systems. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did attackers bypass MFA in the Levi Strauss social engineering breach? Attackers phoned employees on personal mobiles, posed as colleagues or IT support, and directed them to spoofed login pages that harvested both the password and the one-time MFA code in real time. Because the code is captured live during the call, MFA stops being a barrier — the victim reads it out and the attacker uses it immediately before it expires. _Teams hardening against real-time phishing attacks track tactics like these on daily.dev._ ### What is UNC6671 and what industries has it targeted? UNC6671 is Google's umbrella tracking designation for several crews that rely on phone-based social engineering rather than malware. They have targeted manufacturing, healthcare, insurance, technology, hospitality, financial, and legal firms. Google assigns number-based designations until attribution is established, and the group has not been confirmed as responsible for the Levi's breach specifically. _Security engineers following threat actor campaigns and attribution developments keep up on daily.dev._ ## Similar posts on daily.dev - [Attackers pick Levi's pockets in social engineering attack](https://daily.dev/posts/attackers-pick-levi-s-pockets-in-social-engineering-attack-3x6plqtlm) · The Register · 1 upvotes · 1 comments - [One criminal stole info from 50 orgs thanks to no MFA](https://daily.dev/posts/one-criminal-stole-info-from-50-orgs-thanks-to-no-mfa-h2ehlpe08) · The Register · 0 upvotes · 0 comments - [Anatomy of an Attack: The Payroll Pirates and the Power of Social Engineering](https://daily.dev/posts/anatomy-of-an-attack-the-payroll-pirates-and-the-power-of-social-engineering-bxd3az0g9) · Unit 42 · 0 upvotes · 0 comments - [Attacks on US firms have moved from stealing data to stopping production](https://daily.dev/posts/attacks-on-us-firms-have-moved-from-stealing-data-to-stopping-production-eigovylbw) · The Next Web · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#ransomware](https://daily.dev/tags/ransomware), [#data-exfiltration](https://daily.dev/tags/data-exfiltration) [View this post on daily.dev](https://daily.dev/posts/hackers-talked-their-way-into-levi-s-and-three-computers-were-enough-xrlx6bcys) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers talked their way into Levi’s, and three computers were enough","url":"https://daily.dev/posts/hackers-talked-their-way-into-levi-s-and-three-computers-were-enough-xrlx6bcys","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-talked-their-way-into-levi-s-and-three-computers-were-enough-xrlx6bcys"},"datePublished":"2026-08-10T20:45:06.028Z","dateModified":"2026-08-10T20:46:06.028Z","description":"Levi Strauss disclosed a cybersecurity breach in an SEC filing after attackers used social engineering — not software exploits — to access three employees'...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/40a824389915996b002bb849865a6c21?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/40a824389915996b002bb849865a6c21?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Next Web","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Next Web","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/tnw","url":"https://daily.dev/sources/tnw"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackers-talked-their-way-into-levi-s-and-three-computers-were-enough-xrlx6bcys","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,ransomware,data-exfiltration","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Next Web","item":"https://daily.dev/sources/tnw"},{"@type":"ListItem","position":3,"name":"Hackers talked their way into Levi’s, and three computers were enough"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hackers-talked-their-way-into-levi-s-and-three-computers-were-enough-xrlx6bcys#faq","mainEntity":[{"@type":"Question","name":"How did attackers bypass MFA in the Levi Strauss social engineering breach?","acceptedAnswer":{"@type":"Answer","text":"Attackers phoned employees on personal mobiles, posed as colleagues or IT support, and directed them to spoofed login pages that harvested both the password and the one-time MFA code in real time. Because the code is captured live during the call, MFA stops being a barrier — the victim reads it out and the attacker uses it immediately before it expires. Teams hardening against real-time phishing attacks track tactics like these on daily.dev."}},{"@type":"Question","name":"What is UNC6671 and what industries has it targeted?","acceptedAnswer":{"@type":"Answer","text":"UNC6671 is Google's umbrella tracking designation for several crews that rely on phone-based social engineering rather than malware. They have targeted manufacturing, healthcare, insurance, technology, hospitality, financial, and legal firms. Google assigns number-based designations until attribution is established, and the group has not been confirmed as responsible for the Levi's breach specifically. Security engineers following threat actor campaigns and attribution developments keep up on daily.dev."}}]} ```