Under Armour says it is investigating claims that customer data was posted online after an incident linked to the Everest ransomware group, with reports centering on roughly 72 million email addresses. Information in the leaked dataset is described as including email addresses and other personal details, while the company says there is no evidence that payment systems or customer passwords were affected.
The incident has drawn attention because multiple sources describe a large volume of customer records and because the leaked information could be used in phishing and fraud attempts that look more believable. The breach data has also been added to the Have I Been Pwned breach notification service, which allows people to check whether their email address appears in the dataset.
What’s been reported as exposed
Have I Been Pwned says customer data tied to Under Armour was published in January 2026 on a “popular hacking forum” and includes 72 million email addresses. The same breach entry says many records also contain additional personal information such as names, dates of birth, genders, geographic locations, and purchase information.
An Associated Press report carried by ABC News similarly says 72 million email addresses were affected and that some of the records included names, genders, birthdates, and ZIP codes. AUSCERT’s weekly review also describes “about 72.7 million customer accounts” compromised and says the leaked data includes names, email addresses, dates of birth, genders, geographic locations, and detailed purchase histories.
A Malwarebytes report cites a post claiming the dataset contains 191,577,365 records and 72,727,245 unique email addresses, and it describes the poster’s claimed fields as including full names, email addresses, phone numbers, physical locations, genders, purchase histories, and preferences. dig.watch reports that the leaked material includes 72 million email addresses along with names, dates of birth, location details, and purchase histories.
What Under Armour says so far
Under Armour told ABC News it is looking into the claims and said: “We have no evidence to suggest this issue has affected UA.com or systems used to process payments or store customer passwords.” In the same statement, the company added: “Any implication that sensitive personal information of tens of millions of customers has been compromised is unfounded.”
ABC News also reported there were “no signs the hackers stole any passwords or financial information” based on what was known at the time of the report. Have I Been Pwned’s Troy Hunt told ABC News he agreed with Under Armour’s assertion based on the information that had emerged so far, while also saying he was surprised by the lack of an official disclosure statement from the company.
How the leak is tied to Everest ransomware
Have I Been Pwned says that in November 2025 the Everest ransomware group claimed Under Armour as a victim and attempted to extort a ransom, alleging it had obtained access to 343GB of data. The same source says that in January 2026, customer data from the incident was then published publicly on a popular hacking forum.
AUSCERT likewise says the ransomware group Everest is “allegedly behind” the breach and describes the attack as believed to have occurred in November 2025. AUSCERT also says the incident came to light after a member of the Everest group posted leaked files to a cybercrime forum on 18 January 2026 after the company did not pay an undisclosed ransom demand within seven days.
Malwarebytes reports that Everest claimed responsibility and said Under Armour “failed to respond by the deadline,” and it also quotes the Everest leak site as saying that after full publication the data was duplicated across hacker forums and leak database sites. Malwarebytes adds that the breach narrative has split between “cautious corporate statements” and what it calls mounting evidence that a large customer dataset is circulating online.
Why this kind of data leak matters
dig.watch says security analysts warn that datasets combining personal identifiers with behavioral data can raise risks beyond the initial exposure. It also reports that experts say verified customer information tied to a recognized brand can support convincing phishing and fraud campaigns, including messages that reference real transactions or purchase behavior.
AUSCERT says that while credit card numbers do not appear to be included in the specific dump it describes, the “sheer volume” of data poses a severe risk for targeted phishing and identity theft. Malwarebytes also warns customers to watch for impersonators and phishing attempts after a breach and recommends steps like changing passwords and enabling two-factor authentication.
