Under Armour Data Breach: Everest Ransomware Group Leaks 72 Million Customer Records

The Everest ransomware group posted a database of 191,577,365 records to a hacking forum on January 18, 2026, claiming the data was stolen from Under Armour. The dataset contains 72,727,245 unique email addresses alongside personal information, making it one of the largest consumer data dumps of 2026.

What Was Exposed

The exposed data includes names, dates of birth, genders, geographic locations, purchase history, phone numbers, and employee contact details. Under Armour stated it found "no evidence" that the breach affected payment processing on UA.com or compromised account passwords. The breach is believed to have originated in November 2025, meaning the attackers had approximately two months of access before the data appeared publicly. The 72 million unique email addresses have been indexed by Have I Been Pwned.

Extortion Tactics

Everest's public posting of the data illustrates a shift in ransomware group tactics that has intensified in 2025-2026: when ransom demands go unpaid, groups publish stolen data on underground forums rather than deleting it. This serves dual purposes — it punishes non-paying victims visibly, reinforcing consequences for future targets, and allows the data to be monetized through resale or exploitation by other threat actors.

The combination of purchase history, date of birth, phone numbers, and email addresses creates a dataset highly valuable for targeted phishing campaigns. Unlike breaches exposing only email addresses, the richness of this dataset gives attackers enough context to craft convincing pretexts — referencing specific purchases, for example — substantially increasing the probability of victim engagement with malicious messages.

Legal Consequences

Multiple class-action lawsuits have been filed in federal courts in Maryland and Texas. The lawsuits allege inadequate data security practices and seek damages for affected consumers. Maryland is Under Armour's headquarters jurisdiction. The legal theories center on negligence in data protection and failure to implement reasonable security measures for personal consumer information.

Recommendations

Individuals with Under Armour accounts should check their email on Have I Been Pwned, enable multi-factor authentication, and be alert to phishing attempts referencing Under Armour purchases or account details. While passwords were not exposed, attackers with email and purchase history can craft highly targeted social engineering attacks that do not require credential theft.