Sports apparel and fitness technology company Under Armour is currently investigating claims of a significant data breach after a cybercriminal reportedly posted millions of customer records on a hacker forum. The incident, which has drawn widespread attention, allegedly impacts up to 72 million individuals.

News of the potential data theft gained traction this week when the breach notification service Have I Been Pwned obtained a copy of the stolen data. Subsequently, the service notified 72 million individuals via email that their personal information might have been compromised.

According to TechCrunch, which also obtained a sample of the exposed data, the breach is believed to have occurred in November. At that time, the Everest ransomware gang publicly claimed responsibility for the attack on its dark web leak site.

Details of the Compromised Data

The dataset obtained by Have I Been Pwned and reviewed by TechCrunch reportedly includes a range of personal details:

  • Names
  • Email addresses
  • Genders
  • Dates of birth
  • Approximate geographic locations (based on postcode or ZIP code)
  • Information related to customer purchases

TechCrunch noted that the sample provided by the seller contained millions of records, consistent with the types of data reported by Have I Been Pwned. Intriguingly, the stolen data also contained numerous email addresses belonging to Under Armour employees.

Under Armour's Response

When contacted for comment, Under Armour spokesperson Matt Dornic confirmed the company's awareness of the situation.

“Our investigation of this issue, with the assistance of external cybersecurity experts, is ongoing. Importantly, at this time, there’s no evidence to suggest this issue affected UA.com or systems used to process payments or store customer passwords,” Dornic told TechCrunch.

Dornic further stated that the number of affected customers with "any sort of information that could be considered sensitive is a very small percentage." He also refuted implications that sensitive personal information of tens of millions of customers had been compromised, calling such claims "unfounded."

However, the spokesperson did not clarify what specific types of customer information Under Armour classifies as "sensitive," nor did he provide an exact figure for the total number of customers impacted by the breach.

Unanswered Questions

Under Armour has not yet indicated whether it plans to notify customers whose information may have been compromised. The company also remained silent on whether it had received any communication from the hackers, such as a ransom demand.