Full Report
Have I Been Pwned reckons 72.7M customer accounts affected, sportswear firm remains silent Have I Been Pwned (HIBP) says 72.7 million accounts registered with Under Armour were affected by an alleged ransomware attack in November.…
Analysis Summary
# Incident Report: Under Armour Customer Data Leak via Alleged Ransomware Attack
## Executive Summary
In November (exact date unknown), Under Armour was allegedly targeted by the Everest ransomware group, leading to a significant data breach. Have I Been Pwned (HIBP) confirmed the availability of customer data on January 18 when it ingested files leaked by the attackers on a cybercrime forum. Approximately 72.7 million customer accounts were impacted by this apparent double-extortion event. Under Armour has remained silent and has not officially acknowledged the alleged incident.
## Incident Details
- Discovery Date: January 18, 2026 (Date HIBP ingested leaked data)
- Incident Date: November 2025 (Alleged attack period)
- Affected Organization: Under Armour
- Sector: Retail/Sportswear
- Geography: Not specified (Implied US-based operations/customers)
## Timeline of Events
### Initial Access
- Date/Time: November 2025 (Implied)
- Vector: Ransomware/Extortion (Specific initial vector unknown from source)
- Details: The Everest ransomware group claimed to have compromised the network and exfiltrated data in November, threatening to release it unless a ransom was paid.
### Lateral Movement
- Date/Time: Post-November 2025
- Vector: Unknown
- Details: Attackers successfully gathered sensitive customer data for later exfiltration/leak.
### Data Exfiltration/Impact
- Date/Time: Prior to January 18, 2026
- Vector: Data Leak/Extortion
- Details: Attackers posted customer data on a cybercrime forum. HIBP confirmed the data contained names, emails, DOBs, gender, location, and purchase history. Everest claimed inclusion of phone numbers, physical addresses, loyalty program details, and preferred stores.
### Detection & Response
- Date/Time: January 2026 (Public confirmation via HIBP)
- Vector: Third-party data validation (HIBP)
- Details: Under Armour’s response remains silence, failing to respond to inquiries regarding the November attack claims or the January data leak. A proposed class action lawsuit was filed shortly after the leak confirmation.
## Attack Methodology
- Initial Access: Unspecified compromise (Likely leveraging known ransomware techniques against the target).
- Persistence: Unknown, assumed active until data was posted publicly.
- Privilege Escalation: Unknown.
- Defense Evasion: Unknown.
- Credential Access: Unknown.
- Discovery: Unknown.
- Lateral Movement: Unknown.
- Collection: Successful gathering of extensive customer personally identifiable information (PII) and commercial data.
- Exfiltration: Uploading stolen files to a public cybercrime forum (Double Extortion).
- Impact: Data disclosure and subsequent legal action.
## Impact Assessment
- Financial: Potential costs associated with litigation (Class action filed) and necessary security remediation; ransom demand amount is undisclosed.
- Data Breach: **72.7 Million Customer Accounts** affected. Data included Names, Email Addresses, Dates of Birth, Genders, Geographic Locations, Purchase History. Everest claimed Phone Numbers, Physical Addresses, Loyalty Program Details, and Preferred Stores were also compromised.
- Operational: No immediate operational disruption reported, but significant reputational risk due to silence.
- Reputational: Negative impact due to extensive data leak and the organization's failure to publicly acknowledge or comment on the incident.
## Indicators of Compromise
- N/A (The source material only details the *outcome* of the compromise via a third-party ingest, not the technical artifacts used by the Everest group.)
## Response Actions
- Containment: Not disclosed.
- Eradication: Not disclosed.
- Recovery: Not disclosed.
*Note: The primary observed action was the customer disclosure via HIBP and the filing of litigation against the company.*
## Lessons Learned
- Lack of transparency severely compounds reputational damage following a confirmed breach.
- A prolonged period between the initial attack (November) and public awareness (January) suggests significant internal detection/handling delays or a deliberate decision to withhold information.
- Under Armour failed to effectively manage the threat actor's double-extortion demands, resulting in public disclosure of sensitive data.
## Recommendations
- Immediately establish and communicate a clear, transparent incident response protocol for external disclosure when third parties (like HIBP) confirm data leaks.
- Review and reinforce multi-factor authentication (MFA) for all internal systems and customer-facing applications to mitigate initial access risks.
- Conduct a deep forensic investigation to understand the specific initial access vector used by the Everest group to prevent recurrence.
- Enhance data segmentation and minimization strategies to reduce the volume of PII available for bulk exfiltration in future incidents.