Under Armour Data Breach (2025): What Was Exposed & What To Do

In November 2025 the Everest ransomware group listed Under Armour as a claimed victim and stated it had obtained access to 343 GB of data. Customer records from the incident later appeared on a public hacking forum in January 2026, exposing information tied to 72.7 million individuals. The listing and subsequent publication constitute the only confirmed public details available at this stage. No independent verification of the initial access method or the full volume of material has been released by Under Armour or by investigators.

Breaking down the breach

The incident first surfaced publicly on 17 November 2025 when Everest posted Under Armour on its leak site and demanded payment. The group asserted it held 343 GB of material. In January 2026 portions of that material, containing 72.7 million records, were posted on a separate hacking forum. The published sample included email addresses for approximately 72 million entries along with additional fields in many records.

No official statement from Under Armour has disclosed the date or vector of initial compromise, the precise scope of systems accessed, or whether the full 343 GB claim was accurate. The only confirmed public record remains the forum posting of the 72.7 million records.

The group behind it: everest

Everest is a ransomware operation that maintains a leak site to pressure victims and that has previously published data from organisations that refused payment. Its standard pattern involves initial network access, data exfiltration, encryption of systems, and a ransom demand followed, in some cases, by public disclosure when negotiations fail. The group’s listing of Under Armour followed this established sequence, though the company’s response to the demand remains undisclosed.

Under Armour and its sector

Under Armour is a global sportswear and footwear company that maintains large volumes of direct-to-consumer customer accounts. Retailers of this type routinely store names, contact details, dates of birth, purchase histories and location data to support online sales, loyalty programmes and shipping. A breach at such a firm therefore involves the kinds of records that can be aggregated for marketing or identity-related misuse.

The information in question

The records released on the forum contained email addresses, names, dates of birth, genders, geographic locations and purchase information. The exact number of records that included each additional field has not been published, nor has any confirmation been given that other categories of data were absent from the full set. Organisations in this sector commonly hold further details such as passwords, payment card tokens or account credentials, but those elements are not named in the available reporting.

The real-world impact

Exposed email addresses combined with names and dates of birth can be used for targeted phishing or to populate larger datasets sold on underground markets. Purchase histories may reveal spending patterns or product preferences that could be leveraged for social-engineering attempts. For Under Armour the incident adds to the operational costs of incident response, potential regulatory scrutiny and the need to restore customer trust. No evidence of immediate large-scale fraud campaigns linked to this specific dataset has been reported publicly.

Were you affected?

Individuals can check whether their email address appears in known breach datasets by using a free exposure-scanning service that queries public breach repositories. If an address is found, standard precautions include changing passwords on the affected account and any reused elsewhere, enabling multi-factor authentication, and monitoring financial and email accounts for unusual activity. Under Armour has not yet issued a formal notification process, so users should also watch for any direct communications from the company.

AICompiled with AI assistance from public sources and published under our editorial standards.