Under Armour Data Breach: 72M Emails Leaked, What to Do

About 72.7 million email addresses tied to Under Armour customer records are now listed on Have I Been Pwned (HIBP). Per HIBP, the Everest ransomware group claimed Under Armour as a victim in November 2025, alleging it had obtained 343GB of data and trying to extort a ransom, and in January 2026 customer data from the incident was published on a hacking forum. HIBP added the dataset on 21 January 2026. Under Armour says it is investigating with outside cybersecurity experts and has "no evidence to suggest this issue has affected UA.com or systems used to process payments or store customer passwords". The 343GB figure and the attribution to Everest are Everest's claims. We found no Under Armour notification letter, state attorney general filing or SEC filing, and the company has not published its own count.

What was exposed

HIBP lists six data classes for this dataset: dates of birth, email addresses, genders, geographic locations, names and purchases. HIBP says many records also carried additional personal information beyond the email address. AP reported that some records included names, genders, birthdates and ZIP codes. A complaint summarised by Settlement Insight alleges more (phone numbers, passport information, store preferences and browsing histories); those are allegations in a court filing, not facts established by HIBP or the company. Infosecurity Magazine notes that payment card information has not been specifically mentioned.

Timeline

What Under Armour has said

• To AP: "We have no evidence to suggest this issue has affected UA.com or systems used to process payments or store customer passwords."
• To Infosecurity Magazine: "Any implication that sensitive personal information of tens of millions of customers has been compromised is unfounded", and "The security of our systems and data is a top priority for UA, and we take this issue very seriously."
• Per Infosecurity Magazine, it is investigating the claims with external cybersecurity experts.
• Per The Register (21 Jan), it did not respond to questions about the November attack. HIBP's Troy Hunt told AP he agrees with the company's assessment on passwords and payments based on current information, but called the lack of an official disclosure "unusual, especially given the size of the organisation, the scale of the breach".

The lawsuits

Several proposed class actions were filed in the US District Court for the District of Maryland, including Ganesh, Freifeld and Malone. Top Class Actions reports that the Ganesh complaint pleads negligence, negligence per se, breach of implied contract, unjust enrichment, invasion of privacy and declaratory judgment. Per Settlement Insight's docket summary, the cases were consolidated as In re Under Armour, Inc. Data Incident Litigation (No. 1:25-cv-03857) with customers and former employees as plaintiffs, and on 11 September 2026 the court let four claims proceed. A ruling on whether a complaint states a claim is not a finding that Under Armour was negligent. Check the docket for the current status.

What affected people should do

We did not find a notice from Under Armour, so there is no company guidance to quote. The steps below are general good practice, shaped by what HIBP lists and what Under Armour says was not affected.

• Check your address on Have I Been Pwned. It shows whether your email is in this dataset and in others.
• Expect personalised phishing. Names, locations and purchase history make convincing lures. Do not click links or open attachments in unexpected messages that mention Under Armour, an order or a refund; go to the site yourself.
• Use a unique password everywhere and turn on multi-factor authentication for your email and main accounts. Under Armour says passwords were not affected, so a reset is precautionary, but change any password you reused on other sites.
• Watch your accounts. Under Armour says it has no evidence payment systems were affected, and HIBP does not list card data. Review statements as normal.
• Treat unsolicited "breach notification" emails with suspicion. Scammers copy breach news. Verify any notice against the company's own website.

What security leaders should do this week

• Plan for a leak that surfaces before you disclose. Here the claim, a lawsuit and a public breach index all appeared before a company notice we could find. Decide who speaks, and what the first holding statement says, before you need it. The breach notification clock calculator shows which deadlines start when.
• Know what your customer database holds. An email address plus date of birth, location and purchase history is enough for convincing phishing. Inventory fields and retention, and delete what you do not need.
• Monitor leak sites and breach indexes for your own brand. A ransomware leak-site listing is a claim you must be able to triage fast: confirm or rule out, scope, then decide. Practise it in the customer database breach lab.
• Prepare for credential stuffing. Leaked emails fuel attacks on other accounts. Rate-limit logins, check passwords against breached lists and offer MFA; see the credential stuffing lab.
• Warn your own staff and customers about follow-on phishing once you have facts to share, and brief support teams on what to say.
• Run the response checklist against your plan with the data breach response checklist, and note where a monthly view of incidents helps; our January 2026 roundup covers this one briefly alongside the month's other events.

FAQ

Was Under Armour hacked?

The Everest ransomware group claimed in November 2025 that it had taken 343GB of Under Armour data, and customer data was posted on a hacking forum in January 2026. Have I Been Pwned (HIBP) loaded that data and lists it as a breach. Under Armour has said it is investigating with outside cybersecurity experts and that it has no evidence the issue affected UA.com or systems used to process payments or store customer passwords. We found no notice from Under Armour that confirms the scale.

How many people were affected by the Under Armour data breach?

HIBP counts about 72.7 million unique email addresses in the published data (its page cites 72M email addresses). That is a count of addresses in a leaked dataset, not a figure from Under Armour. A company spokesperson told Infosecurity Magazine that "Any implication that sensitive personal information of tens of millions of customers has been compromised is unfounded". Under Armour has not published its own count that we could find.

What data was leaked in the Under Armour breach?

HIBP lists dates of birth, email addresses, genders, geographic locations, names and purchases. AP reported that some records included names, genders, birthdates and ZIP codes. Everest and some outlets say more (phone numbers, physical addresses, loyalty details, preferred stores), but HIBP does not list those, so treat them as claims.

Were passwords or payment cards exposed?

Under Armour told AP: "We have no evidence to suggest this issue has affected UA.com or systems used to process payments or store customer passwords." HIBP founder Troy Hunt told AP he agrees with that assessment based on the information so far. HIBP does not list passwords or payment data for this dataset.

Is Under Armour being sued over the breach?

Yes. Proposed class actions were filed in the US District Court for the District of Maryland, starting with Ganesh v. Under Armour Inc. (No. 1:25-cv-04106), reported on 29 December 2025 by Top Class Actions. A docket summary from Settlement Insight says the cases were consolidated as In re Under Armour, Inc. Data Incident Litigation (No. 1:25-cv-03857), that on 11 September 2026 the court dismissed a fiduciary-duty claim without prejudice and let negligence, breach of contract, unjust enrichment and Maryland Consumer Protection Act claims go forward, and that on 21 September 2026 the case was stayed for mediation. These are allegations and rulings on pleadings, not findings that Under Armour was at fault.

How do I check if my email was in the Under Armour breach?

Search your address on Have I Been Pwned (haveibeenpwned.com). It tells you whether your email appears in the Under Armour dataset and which other breaches include it. Do not enter anything other than your email address.

What should I do if I had an Under Armour account?

Expect targeted phishing that uses your name, location or purchase history, and do not click links in unexpected messages that claim to be from Under Armour. Use a unique password on every site and turn on multi-factor authentication for your email. Under Armour says passwords were not affected, so a reset is precautionary, but change it anywhere you reused it. There is no sign of payment card exposure from Under Armour, but review card statements as normal practice.

Sources

• Have I Been Pwned: Under Armour breach page (added 21 Jan 2026), the primary source for the dataset size and data classes
• AP via WBRC: Under Armour looking into data breach affecting customers' personal information (22 Jan 2026), for Under Armour's statement and Troy Hunt's comment
• The Register: Everest ransomware gang said to be sitting on mountain of Under Armour data (21 Jan 2026)
• Infosecurity Magazine: Under Armour investigates data breach after 72 million records allegedly exposed
• Top Class Actions: Under Armour class action alleges company failed to protect customer data (29 Dec 2025)
• Settlement Insight: Under Armour data breach lawsuit, a secondary docket summary (consolidation, ruling, stay), not checked against the court docket
• Bloomberg Law: Under Armour loses bid to toss lawsuit over 2025 data breach (14 Sep 2026; only the lead was readable)
• DataBreach.com: Under Armour, for the 16 Nov listing date as reported there; its row count and attack date are unverified and not used

PlayCISO is independent and not affiliated with Under Armour or any party named here. This article is general information for security leaders and affected customers, not legal advice or a forensic report. Check the sources for the latest details.