About 72 million Under Armour customer email addresses and other data exposed
Data containing about 72 million Under Armour customer email addresses, along with some names, genders, dates of birth and other information, was published online. The Everest ransomware group claimed to have stolen the data in November 2025, and Under Armour said in January 2026 that it was investigating. The company said there was no evidence that customer passwords or payment systems had been affected. In March 2026, it was confirmed that 541,773 email addresses belonging to users in South Korea, along with 36 names and 36 gender entries, had been exposed, and that the attacker had used a compromised valid employee account to gain unauthorised access to a secure FTP server.
Key facts
- Affected organisation
- Under Armour
- Incident type
- Ransomware
- Occurred / detected
- Not confirmed
- Scale of damage
- About 72 million email addresses and some customers’ personal information; 541,773 email addresses belonging to users in South Korea, along with 36 names and 36 gender entries
- Cause / method
- Unauthorised access to a secure FTP server supporting marketing cloud operations using a compromised valid employee account
- Location
- United States
If your data was exposed
Exposed dataNameEmailDate of birth
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
Timeline
- The Everest ransomware group claimed to have stolen data on millions of Under Armour users.
- A lawsuit was filed against Under Armour over the ransomware group’s data breach claims.
- After about 72 million customer records were published online, Under Armour said it was aware of the breach claims.
- Under Armour said it was investigating the leaked data and had found no evidence that customer passwords or payment systems had been affected.
- Under Armour’s report to the Korea Internet & Security Agency (KISA) confirmed the exposure of 541,773 email addresses belonging to users in South Korea, along with 36 names and 36 gender entries, as well as unauthorised access to a secure FTP server using a compromised employee account.
- A court ruled that Under Armour must face litigation over the large-scale data breach.
19 related reports
- Everest Ransomware Says It Stole Data of Millions of Under Armour Users
- Under Armour Sued After Ransomware Group Reports Data Breach (1)
- 72.7M Under Armour accounts hit in alleged ransomware leak
- Under Armour says it's 'aware' of data breach claims after 72M customer records were posted online
- Under Armour ransomware breach: data of 72 million customers appears on the dark web
- Under Armour Ransomware Attack Exposes 72M Email Addresses
- Dark Web Profile: Anubis Ransomware
- Under Armour looking into data breach affecting customers' email addresses
- Who is Behind Under Armour's Reported Data Breach?
- Under Armour investigating data breach stealing customers' personal info
- Ransomware Hackers Leak Under Armour Customer Data
- Under Armour Customer Data Breach 2025: Technical Analysis of Everest Ransomware Attack and Exposed Email Addresses
- Under Armour Data Breach Impacts 72 Million Consumers Exposing PII
- Under Armour data breach claims trigger alerts for millions of users
- Was Your Data Exposed in the Latest Under Armour Breach? Here’s What You Should Do
- [단독]스포츠웨어 기업 '언더아머', 개인정보 유출…"규모 파악 중"
- [단독] 언더아머 해킹, 이메일 54만개 유출…침투 경로는 '깜깜이'
- Under Armour Can't Duck Suit Alleging Massive Data Breach
- Everestランサムウェア、Under Armourを標的とした大規模なデータ侵害を主張
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.