Hacker Claims Millions of Nike Customer Records

On July 9, 2026, a newly created account on a popular hacking forum claimed to have stolen millions of Nike customer records, including registration data, order information, and personally identifiable information. The seller posted a sample dataset and listed the full cache — roughly 40GB and estimated in the eight-figure range of records — for sale. Public reporting indicates the data may have come directly from Nike or from a third-party partner that handles customer information.

Reported Details of the Claim

Analysis of the sample JSON file showed it contained a mix of customer registration details, order history, and other personal data, but it also included duplicates and what appeared to be log entries. This has led security researchers to question whether the material was taken straight from Nike’s systems or from an external vendor. The claim surfaced months after Nike experienced a separate corporate ransomware incident earlier in 2026, and available reporting describes the two events as distinct. No confirmation has been issued by Nike at the time of writing.

Why This Matters for You and Your Family

If your email, phone number, shipping address, or purchase history is in the exposed set, the information can be used to impersonate you, attempt account takeovers on other sites, or target your family members with phishing messages that look legitimate because they reference real Nike orders. Customer registration data and order information are particularly useful to criminals because they often contain enough detail to answer security questions or reset passwords elsewhere. For households with children who use the same email addresses or shared family accounts, the risk extends beyond the adult who made the purchase.

The Doxxing and Identity-Chain Risks

Leaked customer records like these rarely stay isolated. Criminals combine them with other breaches to build detailed profiles that link your Nike username, email, phone, physical address, and purchase patterns. Once those connections are mapped, attackers can move from simple credential theft to full identity takeover, including social-media impersonation, doxxing, or even targeting children’s gaming accounts that reuse the same passwords or recovery emails. Public reporting on similar incidents shows these chains can escalate quickly once the initial dataset appears on a forum.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity, then use the cleanup to remove what you can.
• Rotate any password you used on Nike.com anywhere else it is reused, and switch to 2FA through an authenticator app instead of SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is flagged within hours rather than months.
• Cover the household with DoxxScan family protection, which includes dependents and children’s gaming accounts that often chain back to the same addresses or recovery details.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing your own accounts.

The incident is a reminder that one retail breach can quietly feed larger identity chains that affect every member of your household. Starting with a clear picture of where your information already sits online gives you the best chance of stopping the next stage before it begins. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects usernames to real identities, and hands-on remediation by specialists who manage takedowns for you — with full household coverage that extends to your children’s gaming accounts.