Quick Summary
Under Armour reportedly suffered a ransomware attack affecting 72.7 million accounts in November, with data including names, emails, and purchase details leaked by the Everest ransomware group. The breach was confirmed by Have I Been Pwned on January 18, after Everest threatened to release the data unless a ransom was paid. A class action lawsuit has already been filed against Under Armour following the incident.
The Securityish Brief
The Everest ransomware group has claimed responsibility for a significant data breach involving Under Armour, impacting 72.7 million accounts. This breach was first reported in November, with the details emerging when Everest leaked the data on January 18 via a cybercrime forum. The leaked information includes names, email addresses, dates of birth, genders, geographic locations, and details of previous purchases, as confirmed by Have I Been Pwned.
In addition to the confirmed data types, Everest also claimed that phone numbers, physical addresses, loyalty program details, and preferred stores were part of the stolen data. Under Armour has not publicly acknowledged the breach or responded to inquiries regarding the attack.
The Everest group, which has been active since 2020, has a history of high-profile attacks, including incidents involving Collins Aerospace and the Brazilian government. Their operational model includes double extortion ransomware, network access brokerage, and an insider recruitment program, allowing them to generate revenue while maintaining a lower profile compared to other ransomware groups.
Implications for Users and Organizations
This incident highlights the ongoing risks associated with ransomware attacks, particularly for organizations handling large volumes of personal data. Users of Under Armour should be vigilant about potential phishing attempts that may arise from the leaked information.
Organizations must ensure robust cybersecurity measures are in place, including regular audits of data security practices and employee training on recognizing suspicious activities. The class action lawsuit filed by a customer underscores the legal and reputational risks companies face following such breaches.
As ransomware tactics evolve, companies should consider investing in advanced threat detection systems and incident response plans to mitigate the impact of potential attacks. Monitoring for unusual account activity and implementing multi-factor authentication can also help protect sensitive information.
Key Takeaways
- Monitor your Under Armour account for any unusual activity following the data breach.
- Change your passwords and enable multi-factor authentication on your accounts to enhance security.
- Be cautious of phishing emails that may use your leaked information to trick you.
- Consider reviewing your data security practices if you manage sensitive customer information.
- Stay informed about developments in the Under Armour breach and any legal actions that may arise.
Key Terms & Concepts
- Ransomware: In this article, ransomware refers to malicious software that encrypts data and demands payment for its release.
- Double extortion ransomware: This term describes a ransomware tactic where attackers not only encrypt data but also threaten to leak it unless a ransom is paid.
- Class action lawsuit: A class action lawsuit is a legal action filed on behalf of a group of people who have suffered similar harm, in this case, Under Armour customers.
Read the original article here: https://go.theregister.com/feed/www.theregister.com/2026/01/21/under_armour_everest/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
