According to CyberInsider and The Register, Have I Been Pwned added data allegedly from Under Armour affecting about 72 million email addresses and personal details, after the Everest ransomware group claimed the company in late 2025 [3][2]. According to TechCrunch and SecurityWeek, Under Armour said it is aware of claims an unauthorized third party obtained certain data, its investigation is ongoing, and there is no evidence UA.com, payment systems or password storage were affected [1][4]. CyberInsider advises users who received an HIBP alert to monitor bank and credit activity, treat unsolicited emails and SMS with heightened vigilance, and change reused passwords [3].
This event has not been officially confirmed. Content is based on media or third-party reports.
Backfill: this event became public on Jan 21, 2026 and we added it on Nov 11, 2026. It is not a new event.
HighMonitoringBackfillMedia reported
Under Armour customer data posted on hacking forum, about 72 million emails exposed
1 min read
- Disclosed
- Jan 21, 2026
- Occurred
- Nov 1, 2025
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- Scale
- 72,000,000 accounts[4]
- CVSS basis
- Our assessment
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
Timeline
Technical details
What happened
According to CyberInsider, the Everest group claimed in late 2025 to have stolen 343GB from Under Armour and demanded a ransom; the data later spread to underground forums in January 2026 [3]. According to The Register, an Everest member leaked the files on a cybercrime forum on January 18, and HIBP says about 72.7 million accounts were affected [2].
Impact
SecurityWeek, citing HIBP, says about 72 million email addresses were affected [4]. According to TechCrunch, Under Armour said there is no evidence UA.com, payment or password systems were affected [1].
What to do
Those who received an HIBP alert should monitor financial activity, watch for suspicious messages and change reused passwords [3].
References
Media4
- [1]TechCrunch2026-01-22Accessed 2026-11-11Snapshot 2026-11-11 sha256 3f9e8306feac
“When reached for comment, Under Armour spokesperson Matt Dornic told TechCrunch that the company is “aware of claims that an unauthorized third party obtained certain data.””
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.