Cyber Incident Victim: Adidas
Date:
May 2025
Location:
Germany
Summary
Adidas reported that an unauthorized external party accessed certain consumer data via a third‑party customer service provider, emphasizing that passwords and credit card details were not compromised. The exposed information primarily included contact details of individuals who had previously reached out to the company’s help desk. Upon discovery, the company moved quickly to contain the incident, engaged leading information security experts to conduct a thorough investigation, and began notifying potentially affected consumers.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On May 23, 2025, Adidas announced that an unauthorized external party had accessed certain consumer data via a third‑party customer service provider. The company stated that the breach did not involve passwords or credit card information. Adidas said it immediately took steps to contain the incident after discovering the unauthorized access. A comprehensive investigation was launched, with the company collaborating with leading information security experts. The statement emphasized that the incident was identified through monitoring of the third‑party provider’s systems. Adidas confirmed that the breach was limited to data obtained through the customer service help desk channel.
The compromised data primarily consisted of contact information for consumers who had previously contacted Adidas’ customer service help desk. No financial or authentication details were reported as exposed. Adidas indicated that it is in the process of notifying potentially affected consumers about the breach. The company said it would continue to work with security experts to fully understand the scope and prevent further unauthorized access. Adidas reiterated its commitment to protecting consumer privacy and maintaining trust. The notification process aims to allow affected individuals to take any necessary precautions regarding their contact details.