Under Armour Data Breach (2025)

On November 17, 2025, the Everest ransomware group claimed responsibility for breaching sportswear giant Under Armour, later publishing customer data belonging to 72.7 million people on a popular hacking forum in January 2026.

What Public Reporting Shows

Public reporting indicates the attackers exfiltrated 343GB of data. The exposed information includes email addresses, names, dates of birth, genders, geographic locations, and purchase histories. Industry research from sources such as DoxxScan™ continuous monitoring confirms the dataset appeared publicly in early 2026 after the initial extortion attempt failed. The breach affected customers who had created accounts or made purchases through Under Armour’s online systems.

Why This Matters for You and Your Family

When 72.7 million records containing your name, date of birth, email, gender, location, and what you bought become freely available, identity thieves gain an immediate advantage. Criminals combine this data with other leaks to impersonate you, open accounts in your name, or target your family members with convincing phishing messages. Children’s information is often linked through shared family emails or addresses, exposing them to grooming, bullying, or account takeovers on gaming platforms. Once your details are public, the risk does not expire; the data can be resold and reused for years.

The Doxxing and Identity-Chain Implications

A single breach like this rarely stays isolated. Attackers use the exposed emails and names to locate associated usernames on social media, gaming services, and shopping sites. With dates of birth and locations added to the mix, they can map these handles back to your real-world identity. This process, known as doxxing, frequently leads to harassment, swatting, or extortion. Credential leaks of this type commonly cascade into gaming account takeovers, where children’s profiles become entry points for further compromise because the same passwords or recovery emails are reused across services.

Everest Ransomware Group Track Record

Public reporting attributes the attack to the Everest ransomware group, which emerged in 2021. The group has targeted organizations across healthcare, manufacturing, and retail sectors. Notable prior victims include financial firms and logistics companies whose data was published after ransom demands went unpaid. Their typical playbook involves initial access through compromised credentials or remote desktop vulnerabilities, followed by exfiltration of sensitive files and deployment of ransomware. When payment is refused, they publish samples and eventually the full dataset on underground forums, using the leak itself as the final extortion tactic.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Rotate the password you used at Under Armour anywhere else it appears, and switch on two-factor authentication through an authenticator app instead of SMS.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or recovery email.
• Let remediation specialists handle takedown requests across data brokers and exposed profiles while you focus on securing your remaining accounts.

The Under Armour breach demonstrates that even large, established retailers remain targets and that published customer data creates permanent risk for ordinary families. Starting protective measures now limits how far criminals can travel along the identity chain created by this and future leaks. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts vulnerable to credential-stuffing attacks.