Cyber Incident Victim: Nike Inc.
Date:
Jan 2026
Location:
United States of America
Summary
Nike experienced a data breach that exposed customers' personal information including names, emails, billing addresses, phone numbers, transaction details and payment card data. The breach was discovered internally but notification to affected individuals was delayed by more than a month. Attackers subsequently released approximately 1.4 terabytes of the stolen data online. A plaintiff filed a class‑action lawsuit alleging that the company failed to adequately protect the data and did not timely inform consumers, seeking damages and injunctive relief.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On January 21, 2026, Nike Inc. discovered a data breach within its information network that had exposed consumer personally identifiable information. The company later determined that the breach stemmed from a ransomware attack that allowed unauthorized access to its systems. Notification of the breach to affected customers was not issued until February 25, 2026, more than a month after the initial discovery. The delay in informing shoppers became a central point of contention in the ensuing litigation.
The compromised data included names, email addresses, billing addresses, phone numbers, transaction details, and payment card information. According to the lawsuit, the attackers released approximately 1.4 terabytes of the stolen Nike data on a public website. This exposure placed individuals at heightened risk of identity theft and fraudulent activity.
Maria Gomez filed a class‑action lawsuit in an Oregon federal court on behalf of herself and other consumers whose privacy was allegedly violated. The complaint asserts that Nike failed to implement reasonable security measures, acted negligently, and unjustly benefited while consumer data was compromised. Gomez seeks a nationwide class, a trial by jury, declaratory and injunctive relief to compel corrective actions, and an award of punitive damages for the harms suffered.