Nike, Inc. Listed by worldleaks Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Breaking down the breach

The incident came to light through a listing on the worldleaks site on December 16, 2025. No further details on the timing of the underlying intrusion, the volume of data involved, or the method of access have been disclosed. The only confirmed element from the listing is the exfiltration of internal files during a ransomware operation. Whether the files were later published or used for additional demands remains unconfirmed.

The group behind it: worldleaks

Worldleaks is a ransomware group that maintains a leak site to list organizations it claims to have targeted. The group typically operates by encrypting systems and threatening to release stolen data if ransom demands are not met. Its listings function as public claims rather than independently verified incidents. In this case the group claims Nike, Inc. as a victim, but no independent confirmation of the underlying events has been reported.

About Nike, Inc.

Nike, Inc. is a major sports apparel and equipment company headquartered in Beaverton, Oregon. Founded in 1964 as Blue Ribbon Sports and renamed in 1971, the company designs, manufactures, and sells footwear, clothing, accessories, and related services across multiple sports categories. Organizations of this scale routinely hold employee records, supplier information, product development files, and customer transaction data as part of normal operations.

What was likely exposed

The listing refers only to internal files exfiltrated during the ransomware attack. No inventory of specific file types, record counts, or data categories has been released. The exact contents therefore remain unconfirmed.

• Internal files referenced in the listing
• No named categories of personal or financial data
• Scale and sensitivity of the files undisclosed

The real-world impact

Until the contents of the exfiltrated files are clarified, the practical risks to individuals cannot be quantified. Internal corporate documents can sometimes contain personal identifiers, contact details, or account credentials, but this has not been established here. For the organization, the incident adds to the operational and reputational costs already associated with ransomware events, including potential regulatory scrutiny and remediation expenses. Both outcomes remain provisional pending further disclosure.

Were you affected?

Begin by monitoring official statements from Nike for any Reported Details on the scope of the incident. Change passwords for any Nike-related accounts and enable multi-factor authentication where available. Review bank and credit statements for unusual activity. Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.