Under Armour Data Breach: 72 Million Customer Records Appear on Dark Web
Under Armour data breach: 72 million customer records on dark web. Change passwords immediately and enable two-factor authentication.
Sportswear giant Under Armour has suffered a major ransomware attack, with data from 72 million customers now circulating on the dark web following a November 2025 breach by the Everest ransomware group.
The compromised dataset contains 191,577,365 records, including 72,727,245 unique email addresses. According to cybersecurity researchers, the exposed information includes full names, email addresses, phone numbers, physical locations, gender information, purchase histories, and customer preferences.
The Everest ransomware group claimed responsibility for the breach after Under Armour allegedly failed to respond by their deadline. The group's leak site confirms the data has been "duplicated across various hacker forums and leak database sites" following full publication.
A class action lawsuit filed in the United States alleges negligence in data protection, though Under Armour's official statements have used cautious language about "potential" impact and ongoing investigations.
Cybersecurity experts note that whilst ransomware groups sometimes exaggerate their access, the extensive distribution of sample data across underground forums suggests a substantial customer database is genuinely compromised.
What Customers Should Do
Anyone with an Under Armour account should take immediate steps to protect themselves:
Change your password immediately, using a strong, unique password not used elsewhere. Password managers can generate secure options automatically.
Enable two-factor authentication (2FA) where possible, ideally using FIDO2-compliant hardware keys or devices which cannot be phished.
Watch for phishing attempts. Scammers may pose as Under Armour or use the breach data to target customers with convincing impersonation attempts. Take your time with any urgent-sounding messages about account suspensions or security alerts.
Consider identity monitoring services which alert you if your personal information appears being traded online.
The breach serves as a reminder of the risks associated with storing personal information online, even with major retailers.
