V.F. Corp: Form 8-K Item 1.05 cybersecurity incident

1. Incident summary

The issuer disclosed a cybersecurity incident under Item 1.05 [8-K 0000950123-23-011228 Item 1.05]. The fields below were derived from that filing by the engine.

• Incident type: unknown (derived) [8-K 0000950123-23-011228 Item 1.05].
• Systems affected: "portion of information technology (IT) systems" and "brand e-commerce order fulfillment" (derived) [8-K 0000950123-23-011228 Item 1.05].
• Containment status: ongoing (derived) [8-K 0000950123-23-011228 Item 1.05].
• Operational status: partial disruption (derived) [8-K 0000950123-23-011228 Item 1.05].
• Data types compromised: PII (derived) [8-K 0000950123-23-011228 Item 1.05].

Issuer metrics are for fiscal year 2023 and come from SEC XBRL companyfacts (as-reported, USD).

2. Business Risk

Business Risk tier by scenario

• Low scenario: The tier is moderate. The basis is partial disruption, under the cyber Business Risk rule, which is internal calibration [scoring.yaml business_tier_rule_cyber].
• Base scenario: The tier is elevated. The basis is an outage of 21 days, which meets the 14-day condition in that rule [scoring.yaml business_tier_rule_cyber].
• High scenario: The tier is elevated. The basis is an outage of 42 days [scoring.yaml business_tier_rule_cyber].

Scenario inputs

• The outage-day scenarios (7, 21 and 42 days) are internal calibration. They are not disclosed by the issuer [scoring.yaml cyber].
• The lost EBITDA figures are internal calibration estimates: $6M (low), $17M (base) and $34M (high) [scoring.yaml cyber].

Affected share and sector

• The affected unit share is 1.0. This is an estimate and an upper bound, because segment count is not reported in XBRL. An analyst-supplied share would replace it [scoring.yaml cyber].
• The sector is "unknown" under the SIC to sector map, which is internal calibration. Sector-specific disruption fractions may therefore not reflect the issuer's apparel and e-commerce exposure [scoring.yaml cyber.sector_map].
• The engine treats compromised PII as a scenario input, under internal calibration [scoring.yaml cyber].

3. Financial Risk

Inputs and data quality

• Ratios are as-reported proxies, and S&P adjustments are not applied. Operating lease liabilities of $1,504M (verified) are reported separately and should be reviewed against the debt figure of $6,630M (derived) [corporate_methodology p.33].
• EBITDA of $590M and FFO of $-684M are derived figures. They should be treated as unverified non-GAAP measures [corporate_methodology p.33].
• CFO of $-656M and cash interest of $160M are verified [corporate_methodology p.33].
• DCF and FOCF are null because capex is missing. Cash flow after investment cannot be assessed from the supplied inputs [corporate_methodology p.33].
• The supplied metrics cover a single fiscal year. The methodology applies five-year time weights of 10/15/25/25/25, which this memo does not apply [corporate_methodology p.32].

Pre-event core ratios (standard table)

Both values are taken from the standard table [corporate_methodology p.33].

The standard table is the engine default. The methodology selects the table from industry and country risk, which the engine does not compute. The medial and low tables were not applied [corporate_methodology p.33] [corporate_methodology p.34].

Post-event core ratios by scenario

All scenario values come from the computed inputs and use the standard table [corporate_methodology p.33].

Financial Risk tier

• No scenario moves either ratio out of band index 5. The pre-event position is already in the last band of the table, so there is no further boundary [corporate_methodology p.33].
• The borderline test, a ratio less than 10% from a range boundary, does not apply because no further boundary exists [corporate_methodology p.32].
• The Financial Risk tier is low in all three scenarios under the internal calibration rule [scoring.yaml financial_tier_rule].
• This tier reflects zero band movement. It does not reflect the level of the pre-event ratios [scoring.yaml financial_tier_rule].

4. Liquidity

• Liquidity was not scored in any scenario. The state is insufficient data, and a missing tier is not treated as low or as a pass [scoring.yaml liquidity.gate_rule].
• Four inputs are missing: contracted asset sales, contracted acquisitions, 12-month working capital change, and expected shareholder distributions. These feed the sources and uses of liquidity [liquidity_descriptors p.8] [liquidity_descriptors p.9].
• Without these inputs, the reference levels cannot be tested [liquidity_descriptors p.13] [liquidity_descriptors p.16]. These levels are:
  • sources over uses of at least 1.2x;
  • sources minus uses staying positive after a 15% EBITDA decline;
  • sources over uses below 1.2x.
• XBRL proxies for prior-year capex and 12-month maturities are part of the internal calibration. Capex was nonetheless missing from the supplied metrics [scoring.yaml liquidity.xbrl_proxies].
• Negative CFO of $-656M (verified) is relevant to the sources side once the remaining inputs are available [liquidity_descriptors p.8].

5. Governance

• No governance flags were raised in the computed inputs [scoring.yaml overlay_rule].
• The governance overlay is downside only. It never lowers a tier and moves it by one step at most. With no flags, it had no effect in any scenario [scoring.yaml overlay_rule].

Overall materiality tier

• The overall tier is the worst of Financial, Business and Liquidity. It is not a weighted average, and dimensions without a tier are skipped [scoring.yaml combination].
• The resulting range is moderate to elevated, with zero unscored cases [scoring.yaml combination].
• Business Risk drives this range in every scenario [scoring.yaml combination].
• These are internal materiality tiers. They are not ratings [scoring.yaml combination].

6. Key watch factors

• Containment and outage duration. Containment is ongoing. Whether the actual outage stays below or exceeds 14 days determines the moderate versus elevated Business Risk tier [scoring.yaml business_tier_rule_cyber].
• Affected share. An analyst estimate of the affected share of the business would replace the 1.0 upper bound and may reduce the scenario impacts [scoring.yaml cyber].
• Sector mapping. A sector assignment other than "unknown" would change the disruption fractions applied [scoring.yaml cyber.sector_map].
• Liquidity inputs. The four missing inputs are needed before Liquidity can be scored against the reference levels [scoring.yaml liquidity.gate_rule] [liquidity_descriptors p.13].
• Capex. Capex data is needed to compute DCF and FOCF [corporate_methodology p.33].
• Ratio table. Table selection based on industry and country risk could change the bands applied [corporate_methodology p.33].
• Multi-year data. Additional fiscal years would allow the time weights to be applied [corporate_methodology p.32].
• Governance disclosures. Any later governance disclosures should be checked for flags that could trigger the downside overlay [scoring.yaml overlay_rule].

7. Sources

Filing

• [8-K 0000950123-23-011228 Item 1.05], V. F. CORPORATION, Form 8-K, Item 1.05. https://www.sec.gov/Archives/edgar/data/103379/000095012323011228/d659095d8k.htm

Criteria excerpts

• [corporate_methodology p.32]: Corporate Methodology, para 116 (five-year time weights) and para 118 (borderline relative distance).
• [corporate_methodology p.33]: Corporate Methodology, Table 17 (standard table ratio ranges) and para 123 (table selection).
• [corporate_methodology p.34]: Corporate Methodology, Table 18 (medial table) and Table 19 (low table).
• [liquidity_descriptors p.8]: Liquidity Descriptors For Global Corporate Issuers, para 23 (sources of liquidity).
• [liquidity_descriptors p.9]: Liquidity Descriptors For Global Corporate Issuers, para 30 (uses of liquidity).
• [liquidity_descriptors p.13]: Liquidity Descriptors For Global Corporate Issuers, para 37 (reference levels).
• [liquidity_descriptors p.16]: Liquidity Descriptors For Global Corporate Issuers, para 40 (reference levels).

Internal calibration (docs/scoring/scoring.yaml)

• [scoring.yaml financial_tier_rule]
• [scoring.yaml business_tier_rule_cyber]
• [scoring.yaml cyber]
• [scoring.yaml cyber.sector_map]
• [scoring.yaml liquidity.gate_rule]
• [scoring.yaml liquidity.xbrl_proxies]
• [scoring.yaml overlay_rule]
• [scoring.yaml combination]

8. Disclaimers

• This memo is an analytical aid. It is not a credit rating or a rating recommendation and does not represent the view of any rating committee.
• It is based only on public information. Figures are as-reported in SEC filings unless labeled derived or estimate.
• Non-GAAP figures (EBITDA, FFO) are derived and unverified.
• Ratios are as-reported proxies without S&P adjustments.
• Materiality tiers and scenario parameters are internal calibration.