Now Hacked
EN
Ransomware

About 72 million Under Armour customer email addresses and other data exposed

First reported · Last reported · 19 related reports

Data containing about 72 million Under Armour customer email addresses, along with some names, genders, dates of birth and other information, was published online. The Everest ransomware group claimed to have stolen the data in November 2025, and Under Armour said in January 2026 that it was investigating. The company said there was no evidence that customer passwords or payment systems had been affected. In March 2026, it was confirmed that 541,773 email addresses belonging to users in South Korea, along with 36 names and 36 gender entries, had been exposed, and that the attacker had used a compromised valid employee account to gain unauthorized access to a secure FTP server.

Key facts

Affected organization
Under Armour
Incident type
Ransomware
Occurred / detected
Not confirmed
Scale of damage
About 72 million email addresses and some customers’ personal information; 541,773 email addresses belonging to users in South Korea, along with 36 names and 36 gender entries
Cause / method
Unauthorized access to a secure FTP server supporting marketing cloud operations using a compromised valid employee account
Location
United States

If your data was exposed

Exposed dataNameEmailDate of birth

  1. Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.

Timeline

  1. The Everest ransomware group claimed to have stolen data on millions of Under Armour users.
  2. A lawsuit was filed against Under Armour over the ransomware group’s data breach claims.
  3. After about 72 million customer records were published online, Under Armour said it was aware of the breach claims.
  4. Under Armour said it was investigating the leaked data and had found no evidence that customer passwords or payment systems had been affected.
  5. Under Armour’s report to the Korea Internet & Security Agency (KISA) confirmed the exposure of 541,773 email addresses belonging to users in South Korea, along with 36 names and 36 gender entries, as well as unauthorized access to a secure FTP server using a compromised employee account.
  6. A court ruled that Under Armour must face litigation over the large-scale data breach.

19 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.