Victoria's Secret payroll account breach: fake login pages and changed direct deposits, October 9 to 16, 2026

Date	Event
October 9 to 16, 2026	Unauthorized logins and direct deposit changes in HR Access accounts
After October 16, 2026	Passwords reset; direct deposit details restored
November 9, 2026	Date on the letter
November 11, 2026	Massachusetts logs the notice (1 resident)

What happened at Victoria's Secret?

This is a payroll diversion scheme, not a break-in to the company's network. Someone searching for the HR Access login can land on a look-alike page; the password typed there goes to the attacker, who logs in to the real account and changes where the paycheck is sent. Victoria's Secret says it reset the password and restored the deposit information so the associate was paid. The letter does not say how many associates were affected.

What information was involved?

The activity itself touched direct deposit information. The account also holds the associate's Social Security number in a separate section, and the company does not know whether that number was viewed. Massachusetts marks only Social Security numbers for this notice, with no financial account, driver's license or card numbers.

Data	Status in the letter
Direct deposit account details	Changed by the intruder, then restored
Social Security number	Stored in the account; unknown whether viewed
Password	Reset by the company

What is Victoria's Secret offering, and when must I enroll?

A 24-month Experian IdentityWorks membership at no cost. The enrollment deadline is short: December 11, 2026. Enroll online with the activation code in the letter, or call Experian at (833) 931-7577, Monday to Friday, 8 am to 8 pm Central, by the same date. Questions about the incident go to DR Direct at 1-888-877-4730, Monday to Friday, 9:00 a.m. to 5:30 p.m. Eastern. Credit monitoring offers in breach letters compares this offer with the others in the log.

How do I avoid fake payroll login pages?

Go to the payroll site from a bookmark or the address your employer gives you, not from a search result or an ad. The letter's own advice is to watch account statements and free credit reports. It also points out that you can order a free report from each of the three nationwide bureaus once a week. One call to a bureau places a free fraud alert with all three.

Is this the same as a customer data breach?

No. The letter is addressed to associates and is about their payroll accounts; it says nothing about customer data or the online store. The company says it is tightening controls on HR Access and on what associates' accounts display. Business email compromise covers the related schemes that divert payments, and the consumer and retail hub lists the other retail notices on record.