Nike Inc.

Summary

Nike faced a class‑action lawsuit after a data breach exposed customers’ names, emails, billing addresses, phone numbers, transaction details and payment card information, with plaintiffs alleging the company failed to secure its network and delayed informing affected individuals. The breach was linked to a ransomware attack that released 1.4 terabytes of data, and the suit claims negligent practices left consumers at risk of identity theft and fraud while seeking damages and injunctive relief.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On January 21 2026 Nike discovered a data breach affecting its information network, after which unidentified attackers exfiltrated a substantial volume of consumer data and subsequently released approximately 1.4 terabytes of that information on a public website. The compromised data included personally identifiable information such as names, email addresses, billing addresses, phone numbers, transaction details, and payment card specifics. Nike did not issue notifications to affected individuals until February 25 2026, a delay of over a month after the breach was initially identified.

On April 7 2026 plaintiff Maria Gomez filed a class‑action lawsuit in an Oregon federal court on behalf of herself and other consumers whose data was exposed in the incident. The complaint alleges that Nike failed to adequately protect its network, thereby allowing unauthorized access to consumer information, and that the company neglected to provide timely notice of the breach. The suit further claims that Nike’s conduct was intentional, willful, reckless, and/or negligent, violating an implied contract and resulting in unjust enrichment while consumer data remained compromised. Gomez seeks nationwide class certification, a trial by jury, declaratory and injunctive relief to compel Nike to correct its alleged wrongdoing, and an award of punitive damages for herself and other class members.

The lawsuit warns that the exposed personal information places affected individuals at imminent risk of identity theft and fraud, emphasizing the potential for ongoing harm stemming from the breach. It asserts that the delayed notification exacerbated the damage by preventing consumers from taking protective measures sooner. The legal action aims to hold Nike accountable for the alleged failures in data security and breach response, requesting judicial intervention to address the alleged harms and to deter similar incidents in the future.

Sources

Sources available to members: 2 sources.