6,727,398 Under Armour customers affected by a data leak

On 18 January 2026, Under Armour — the US sportswear and athletic-apparel brand headquartered in Baltimore — was confirmed to be the victim of a large-scale customer data leak. The data originated from an intrusion claimed by the Everest ransomware gang, which said in November 2025 that it had stolen roughly 343 GB of data and attempted to extort the company. After the extortion attempt, the stolen records were published openly on a hacking forum in January 2026.

The dataset comprises about 72.9 million customer records worldwide, of which roughly 6.7 million relate to people located in France. The breach notification service Have I Been Pwned obtained a copy and alerted the affected individuals. The exposed information did not include passwords or payment-card data — Under Armour stated there was no evidence that UA.com or its payment and password systems were affected — but it did contain extensive personal data.

Exposed data categories included:

• Full names
• Email addresses (customer and some employee addresses)
• Dates of birth
• Gender
• Approximate geographic location (by ZIP/postal code)
• Purchase history

Under Armour acknowledged it was "aware" of the claims and said an investigation was ongoing, while disputing the severity and arguing that only a small percentage of affected customers had information that could be considered sensitive. The incident has since triggered multiple class-action lawsuits filed in US federal courts in Maryland and Texas.