Under Armour is investigating a significant data breach affecting approximately 72 million customers, following the online posting of sensitive records by hackers.
Sportswear and fitness brand Under Armour is currently probing claims of a substantial data breach after customer records were discovered on a hacker forum. The breach came to light when millions of users received alerts indicating that their personal information may have been compromised.
While Under Armour maintains that its investigation is ongoing, cybersecurity experts analyzing the leaked data suggest it contains personal details that could be linked to customer purchases. The breach notification service Have I Been Pwned reported that the dataset includes email addresses associated with around 72 million individuals, prompting the organization to directly notify affected users.
The scale of this exposure has raised significant concerns regarding the potential misuse of consumer data long after a breach has occurred. The stolen data is reportedly tied to a ransomware attack that took place in November 2025, for which the Everest ransomware group claimed responsibility. This group attempted to extort Under Armour by threatening to leak internal files.
In January 2026, customer data from this incident surfaced on a popular hacking forum. Shortly thereafter, Have I Been Pwned obtained a copy of the data and began alerting affected users via email. Reports indicate that the seller claimed the stolen files originated from the November breach and included millions of customer records.
The leaked dataset is believed to encompass a wide range of personal information. While there has been no confirmation regarding the exposure of payment card details, the data remains highly valuable to cybercriminals. Compromised information may include names, email addresses, birth dates, and purchase histories, which can be exploited to create convincing scams.
Researchers have also identified email addresses belonging to Under Armour employees within the leaked data, increasing the risk of targeted phishing and business email compromise scams. An Under Armour spokesperson stated, “We are aware of claims that an unauthorized third party obtained certain data. Our investigation of this issue, with the assistance of external cybersecurity experts, is ongoing. Importantly, at this time, there’s no evidence to suggest this issue affected UA.com or systems used to process payments or store customer passwords. Any implication that sensitive personal information of tens of millions of customers has been compromised is unfounded. The security of our systems and data is a top priority for UA, and we take this issue very seriously.”
Even in the absence of passwords or payment details, this breach poses serious risks. Names, email addresses, birth dates, and purchase histories can be used to craft highly convincing phishing attempts. Cybercriminals often reference actual purchases or account details to gain the trust of their targets. Consequently, phishing emails related to this breach may appear legitimate and urgent.
Over time, exposed data can be combined with information from other breaches to create detailed identity profiles that are increasingly difficult to protect against. To determine if your email has been affected, visit the Have I Been Pwned website, which serves as the official source for this newly added dataset. Enter your email address to check if your information appears in the leak.
If you received a breach alert or suspect your information may be included, taking immediate action can help mitigate future risks. If you have reused the same password across multiple sites, it is advisable to change those passwords promptly. Even if Under Armour asserts that passwords were not compromised, exposed email addresses can be used in follow-up attacks.
Utilizing a password manager can simplify this process by generating strong, unique passwords for each account and securely storing them. This way, a single breach cannot jeopardize multiple accounts. Additionally, check if your email has been exposed in previous breaches. Many password managers now include a built-in breach scanner that verifies whether your email address or passwords have appeared in known leaks. If you find a match, change any reused passwords immediately and secure those accounts with new, unique credentials.
Cybercriminals often act swiftly following a breach. As a result, emails that seem to originate from Under Armour or other fitness brands may appear in your inbox. Exercise caution with messages claiming there is an issue with your account or a recent purchase. Avoid clicking links or opening attachments in unexpected emails; instead, visit the company’s official website directly if you need to verify your account.
Employing robust antivirus software can also help block malicious links and attachments before they can cause harm. To protect yourself from harmful links that may install malware and potentially access your private information, ensure you have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, safeguarding your personal information and digital assets.
Implementing two-factor authentication (2FA) adds an additional layer of security. Even if someone obtains your password, they would still require a second step to log in. Start by enabling 2FA for your email accounts, then extend it to shopping, fitness, and financial accounts. This simple measure can prevent many account takeover attempts linked to breached data.
After a breach, attackers frequently test stolen email addresses across various sites, which can trigger password reset emails that you did not request. Pay close attention to these alerts. If you receive one, secure the account immediately by changing the password and reviewing recent activity.
The Under Armour data breach serves as a reminder that even major global brands can become targets. While payment systems appear unaffected, the exposure of personal data still presents long-term risks for millions of customers. Data breaches often unfold over time, and what begins as leaked records can later fuel scams, identity theft, and targeted attacks. Remaining vigilant now can help reduce the likelihood of more significant issues in the future.
For further information, visit Cyberguy.com, where you can find expert-reviewed password managers, antivirus solutions, and data removal services to help protect your personal information.
According to CyberGuy, the Under Armour data breach highlights the ongoing risks associated with data security in the digital age.
