Under Armour Investigates Everest Ransomware Data Leak Affecting 72M Customers

Under Armour said it is investigating claims that an unauthorized party obtained customer data after a dataset tied to the company was posted to a hacker forum and subsequently ingested by breach-notification services. Have I Been Pwned reported obtaining a copy of the data and notifying roughly 72 million individuals; the exposed information reportedly includes names, email addresses, gender, date of birth, approximate location (postcode/ZIP-derived), and purchase-related data, and also contains numerous Under Armour employee email addresses. Under Armour stated there is currently no evidence the incident affected UA.com or systems used to process payments or store customer passwords, while noting that the portion of customers with “sensitive” information impacted is believed to be small.

Multiple reports tie the leak to a November 2025 intrusion claimed by the Everest ransomware group, which alleged Under Armour failed to meet a negotiation deadline and that the data was then published and redistributed across forums and leak sites. One account describes the theft as involving 343 GB of company data and indicates the forum-posted dataset includes 72 million email addresses plus additional PII and purchase information; another report cites a much larger dataset claim (over 191 million records with ~72.7 million unique email addresses) and notes a US class action lawsuit alleging negligence and large-scale exfiltration, including potential employee data. Reporting also reiterates Everest’s typical tradecraft, including credential-based access and use of remote access tooling (e.g., AnyDesk, Splashtop), though Under Armour has not publicly confirmed the intrusion vector or the full scope of data exfiltration.