Victoria’s Secret & Co. has notified associates about unauthorized access to HR Access, the employee portal that holds payroll and personal details. This page explains what the notice says, what remains unknown and what affected people can do.
The company’s notice is dated November 9, 2026, and a copy was filed with the Massachusetts Attorney General.
Victoria’s Secret & Co.’s Data Breach Investigation
Victoria’s Secret & Co. is a specialty retailer based in Reynoldsburg, Ohio. Like any large employer, it keeps an online portal where associates view pay information and manage where their paychecks are deposited. In its notice, the company calls this portal HR Access and says that the incident involved individual associate accounts within it.
According to the notice, the activity began with scams aimed at employees of many companies. The company describes fake login pages that appear in internet search results and imitate the real payroll sign-in screen. When an employee types credentials into one of those pages, the person running it can then sign in to the genuine account and redirect paychecks to an account they control.
The company says that between October 9 – 16, 2026, an associate’s HR Access account showed signs of an unauthorized login together with changes to direct deposit account details. After spotting the activity, it reset the password on the account and restored the direct deposit information so that the associate was paid as expected.
The more serious concern for associates is what else lives inside the portal. The company explains that HR Access also contains the associate’s Social Security number in a separate section of the account. The notice does not say that the number was taken. It states that the company does not know whether the number was viewed. That distinction matters: the confirmed activity involved payroll changes, while exposure of the Social Security number is a possibility that has not been ruled out.
As a precaution, the company is offering a complimentary 24-month membership to Experian IdentityWorks, a service that watches for misuse of personal information and offers identity restoration help. Associates must enroll by December 11, 2026 using the activation code in their letter. The company also says it has taken and will continue to take steps to strengthen controls over access to HR Access and over the information visible inside associates’ accounts.
The filing with the Massachusetts Attorney General does not state how many people in total received the notice. It does say, in a section for residents of Rhode Island, that the incident involves one individual in that state. Without a published total, it is not possible to say how widespread the account takeovers were, and this page does not estimate one.
Account takeover scams aimed at payroll systems are a recognized and growing problem. Attackers favor them because the payoff is quick, since a single changed deposit instruction can redirect an entire paycheck, and because the first sign is often a missed payment. When the same account also holds a Social Security number, the stakes rise, since that number can be used for tax fraud, new credit applications and other identity theft long after a paycheck issue has been corrected.
Employees at any company can lower this kind of risk by reaching payroll sites only through bookmarks or addresses supplied by their employer instead of search results, by turning on multi-factor authentication where it is offered, and by checking pay statements and deposit details regularly. Using a password for payroll that is different from every other account also limits the damage if one set of credentials is ever exposed, because a thief cannot simply reuse it elsewhere, and a short alert for any deposit change adds another early warning. If you receive a notice from Victoria’s Secret & Co., keep it, because it contains your personal activation code and the engagement number you need to reach Experian.
Anyone who works or used to work for the company and has not received a letter but suspects an HR Access account was misused can ask the company’s HR team, using official contact details, whether their account was among those affected.
When Did This Breach Occur?
The company’s notice says unauthorized logins and direct deposit changes occurred between October 9 – 16, 2026. The notice itself is dated November 9, 2026, and the enrollment window for the free identity protection offer closes on December 11, 2026. The notice does not say when the company first detected the activity or give a separate date for when the scam pages began circulating.
What Information Was Breached?
The confirmed activity involved payroll and direct deposit information inside the associate’s HR Access account. The same account also holds the associate’s Social Security number in a separate section. The company says it does not know whether that number was viewed. It has not listed any other categories of information, such as addresses or dates of birth, as being involved.
What You Can Do
If you received a notice related to Victoria’s Secret & Co. or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Check your pay statements and direct deposit settings in the payroll portal, and use an official bookmark or address from your employer to sign in rather than a search result. Enroll in the Experian IdentityWorks offer before December 11, 2026 if you received a notice.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against Victoria’s Secret & Co.
Attorneys are looking into the Victoria’s Secret & Co. HR Access incident and want to hear from current and former associates who received a notice or who think their payroll account or Social Security number may have been exposed. No lawsuit has been confirmed. Whether you can seek compensation depends on the facts that come out about the incident. An attorney can explain whether you may be able to join a class action lawsuit.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
