Under Armour

Summary

Under Armour is investigating a data breach in which email addresses, names, genders, birthdates, ZIP codes and purchase details of customers were accessed and posted on a hacker forum, with the ransomware group Everest claiming responsibility. Have I Been Pwned reported that approximately 72 million email addresses were involved, though the company states that only a fraction of that number were actually compromised and that there is no evidence passwords, payment information or its main website were affected, while it continues to work with external cybersecurity experts to determine the full scope.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Under Armour’s data breach was first reported in late January 2026, with multiple news outlets noting that the company was investigating a recent incident that had allegedly exposed customer email addresses and other personal information. The breach is believed to have occurred in November 2025, according to statements from Under Armour and information cited by the Have I Been Pwned breach notification service. Have I Been Pwned reported that it obtained a copy of the stolen data and subsequently notified approximately 72 million individuals by email that their information had been compromised. The company acknowledged the claims in a public statement, saying it was aware of an unauthorized third party obtaining certain data and that its investigation, assisted by external cybersecurity experts, was ongoing.

The data that was taken, as described by Have I Been Pwned and corroborated by a sample provided to TechCrunch, included names, email addresses, genders, dates of birth, and approximate locations based on postcode or ZIP code. In addition to customer information, the stolen dataset contained details relating to purchases and included numerous email addresses belonging to Under Armour employees. Under Armour emphasized that, at the time of its statements, there was no evidence to suggest the breach had affected its UA.com website, its payment processing systems, or the storage of customer passwords. The company also said that any implication that sensitive personal information of tens of millions of customers had been compromised was unfounded, noting that the number of affected customers with information that could be considered sensitive represented a very small percentage.

Attribution of the breach was linked to the Everest ransomware gang, which claimed responsibility for the November 2025 data theft in a post on its dark web leak site. A seller who spoke with TechCrunch stated that the data had been taken during that November incident and that the stolen records were later posted to a hacker forum, where they became more widely known after Have I Been Pwned obtained a copy. Under Armour did not confirm receipt of any ransom demand or correspondence from the attackers, and it did not disclose whether it intended to notify customers whose information was included in the leaked data.

Throughout its public communications, Under Armour maintained that the security of its systems and data remained a top priority and that it was taking the incident seriously. The company repeated that it had no evidence of impact on its core e‑commerce or payment platforms and that it continued to work with external cybersecurity experts to investigate the scope and origin of the breach. Have I Been Pwned’s CEO Troy Hunt expressed agreement with Under Armour’s assessment based on the information available, while also noting his surprise at the lack of an official disclosure statement from the company given the size of the organization and the scale of the reported incident. No further details about containment measures, remediation timelines, or specific technical findings were provided in the source material.

Sources

Sources available to members: 5 sources.