Under Armour Breach Exposes Data of 72 Million Users

Sportswear giant Under Armour is facing mounting scrutiny after data allegedly linked to nearly 72 million customers surfaced on the dark web following a ransomware attack attributed to the Everest group. While the company has maintained a cautious public stance, growing evidence suggests that a large customer database may now be circulating across underground forums.

Reports of the breach first emerged in November 2025, when Everest ransomware operators claimed responsibility for an attack on Under Armour. Since then, the company has issued carefully worded statements referring to ongoing investigations and “potential” impact, leaving customers uncertain about the scale of the incident. In contrast, a class action lawsuit filed in the United States alleges negligence in data protection and claims that sensitive customer—and possibly employee—data was exfiltrated during the attack.

Everest operators have stated that Under Armour failed to respond before the ransom deadline, prompting them to publish the stolen data. According to the group’s leak site, the dataset has since been duplicated and shared across multiple hacker forums and leak repositories. Posts advertising the data claim it includes full names, email addresses, phone numbers, physical locations, gender details, and purchase histories.

The leaked database is reportedly made up of more than 191 million records, containing over 72 million unique email addresses. While ransomware groups are known to exaggerate claims, cybersecurity experts note that publishing sample data and distributing it widely is unlikely to be a bluff. The “database leaked” status on Everest’s site further reinforces concerns that a substantial volume of customer data is now exposed.

For affected customers, the conflicting narratives offer little reassurance. Even if some attacker claims prove inaccurate, the likelihood of real-world risk remains high. Security professionals advise customers to change passwords immediately, enable strong two-factor authentication, remain alert to phishing attempts, and avoid storing payment details online. Monitoring services can also help detect misuse of personal data.

As investigations continue, the incident underscores the growing impact of ransomware on major consumer brands and the long-term risks faced by customers when large datasets fall into criminal hands.