In The Event Of
Get started free
U

Under Armour Data Breach 2025:
What You Need to Know

Approximately 72 million Under Armour customer records were exposed after the Everest ransomware group breached the apparel retailer. Here is what happened, what data was leaked, and steps you can take to protect yourself.

Breach date:November 2025
Records affected:~72 million
Risk level:High

Your personal risk from this breach

Sign in or create a free account to see your personalised risk score.

View My Risk

What Happened

How the Under Armour Breach Unfolded

Early November 2025

The Everest ransomware group claimed an attack on Under Armour via its dark-web leak site, listing the apparel retailer among its victims and threatening to publish stolen customer data if a ransom was not paid. Under Armour was notified and began an internal investigation.

Mid-November 2025

Under Armour publicly confirmed the breach, disclosing that approximately 72 million customer records had been accessed. The company stated it would not pay the ransom and engaged external incident response specialists. Affected records included names, email addresses, dates of birth, genders, location data, and purchase information.

Not sure if you received a notification? Affected customers received an email from Under Armour referencing the incident and outlining the categories of data that may have been exposed.

Late November 2025

Have I Been Pwned imported the dataset, allowing customers to check whether their email address appeared in the leaked records. Affected customers continued to receive direct notification emails from Under Armour throughout late November.

Sources: Have I Been Pwned, Under Armour corporate communications

What Was Exposed

Personal Data Leaked in the Breach

The amount of data exposed varies between customers. According to Under Armour, all affected accounts had names and email addresses exposed, while a subset also had additional personal details including date of birth, gender, location data, and purchase history leaked.

Data TypeRisk LevelWho Was Affected
Full nameHighAll approximately 72 million affected customers
Email addressHighAll approximately 72 million affected customers
Date of birthHighSubset of affected customers
GenderLowSubset of affected customers
Location (city/region)MediumSubset of affected customers (derived from billing address)
Purchase informationMediumSubset of affected customers (order history, product preferences)

Risk levels based on the OAIC: What is personal information? and OAIC Australian Privacy Principles. Identity-linked data (name, date of birth, location) is rated higher due to its potential use in identity fraud and targeted phishing.

✅ Confirmed NOT Exposed

Under Armour confirmed that full credit card numbers (PANs), CVV values, and account passwords were not stored in the affected system. Under Armour has historically used bcrypt to hash credentials. Note: Under Armour's 2018 MyFitnessPal breach did expose hashed passwords, but that is a separate incident from the 2025 breach.

Company Response

What Under Armour Did

“We take the protection of our customers' information seriously and are working with leading cybersecurity experts to investigate and respond to this incident.”
Under Armour, customer notification (November 2025)

Actions Taken by Under Armour

  • Refused to pay the ransom demanded by the Everest ransomware group
  • Engaged external incident response and forensic specialists
  • Notified relevant regulators including data protection authorities in affected jurisdictions
  • Began direct email notifications to affected customers in mid-November 2025
  • Reviewed and strengthened internal access controls and monitoring
  • Provided customer guidance on phishing awareness and account security
HIBP Breach ListingUnder Armour Corporate

What Now?

Steps You Can Take After the Under Armour Breach

Even though no passwords or full payment details were exposed, the combination of name email date of birth and location gives scammers enough information to craft convincing impersonation attempts. Here are general best-practice steps, organised by the types of accounts most commonly affected.

Under Armour and Fitness Retail Accounts

Many customers use the same email across MyFitnessPal, SHOP UA, and MapMyRun. Credential overlap is common.

Secure your Under Armour and related fitness accounts

~10 min
It is generally considered best practice to update the password on any Under Armour, SHOP UA, MyFitnessPal, or MapMyRun account associated with the exposed email. Enabling MFA where available adds a significant layer of protection. Review recent orders and saved address details for anything that looks unfamiliar.
Go to Under Armour account

Review other fitness and loyalty accounts

Where the same email or password has been reused across fitness apps, athletic loyalty programmes, or retailer accounts, consider updating credentials on those accounts as well. Credential reuse remains one of the most common ways a single breach leads to broader account takeover.

Email and Digital Identity

Your email is the key to your digital identity. Securing it is a sensible first step.

Strengthen email security

~5 min
Updating the password and enabling MFA on email accounts associated with the breach is widely recommended. It is also worth checking email forwarding rules and connected app permissions, as these can be exploited to silently intercept communications.

Understand your full account exposure

Most people have dozens of online accounts linked to a single email address. When that email is exposed in a breach, understanding which services are connected is a critical first step in assessing personal risk. Tools that map your digital footprint can help identify accounts that may need attention.

Identity Protection

Name + date of birth + location is commonly used in identity verification by financial institutions.

Consider a credit ban (especially if your date of birth and location were exposed)

~20 min
For those whose date of birth and location were included in the exposed data, the combination could potentially be used in fraudulent credit applications or knowledge-based identity verification. Placing a free credit ban with Australian credit bureaus prevents new credit from being opened without additional verification.
Equifax AUExperian AU (formerly Illion)

Watch for targeted phishing referencing your purchases

~5 min
Because purchase information was part of the exposed dataset, scammers may craft emails that reference real Under Armour orders or product preferences to appear legitimate. Treat unsolicited messages about refunds, shipping issues, or loyalty rewards with caution and verify directly through the Under Armour website.

Monitoring and Reporting

Australian, US, and EU resources for breach response and identity protection.

Contact IDCare (AU), FTC (US), or your national DPA (EU)

IDCare (1800 595 160) is Australia's national identity and cyber support service and provides free, tailored guidance for people affected by data breaches. In the United States, the FTC IdentityTheft.gov service offers recovery plans. EU residents can contact their national data protection authority for guidance under GDPR.

Report scams referencing the breach

Reporting suspicious messages to Scamwatch (AU) or equivalent national services contributes to broader awareness and helps authorities track emerging threats stemming from the breach.

Not sure which of your accounts are affected?

In The Event Of discovers your accounts automatically and alerts you in real time when new breaches affect your data.

Check My Email Free

Are You Still at Risk?

The Hidden Danger: Compound Breach Exposure

The Under Armour breach did not happen in isolation. If your data also appeared in other major breaches, the combination of leaked information can build a more complete identity profile that scammers and fraudsters can exploit.

How breach data compounds

On its own, the Under Armour breach exposed names, emails, dates of birth, locations, and purchase information. But if your email also appeared in the 2018 MyFitnessPal breach (a sister brand), the Ticketmaster 2024 breach, or the LinkedIn 2021 scrape, the combined data set may include hashed passwords, partial billing details, and professional history. This kind of compound exposure significantly increases the risk of identity fraud and targeted phishing.

  • MyFitnessPal (2018)150M records - email, hashed password (Under Armour sister brand)
  • Ticketmaster (2024)560M records - name, address, partial billing details
  • LinkedIn (2021)700M records - name, phone, employer information
  • MOAB (2024)26B aggregated credentials from prior breaches

If your email appears in two or more of these breaches, your risk level is significantly elevated. In The Event Of can overlay your breach data to show exactly where your exposure compounds, and help you prioritise what to address first.

Were you affected?

Find out in 30 seconds. Free to check.

Check My Email Free

No credit card required.

Frequently Asked Questions

Under Armour Breach FAQ

Sources

  1. Have I Been Pwned: Under Armour breach listing
  2. Under Armour: Corporate communications and customer support
  3. OAIC: Notifiable Data Breaches scheme
  4. OAIC: What is personal information? (Privacy Act 1988 categories)
  5. OAIC: Australian Privacy Principles

Other Major Australian Data Breaches

Data from multiple breaches can be combined to increase identity fraud risk. Review these guides to understand your full exposure.

NYC Health + Hospitals Data Breach 2026

~1.8M records exposed

Critical

Australian Courts Data Breach 2026

Thousands of files records exposed

Critical

youX Data Breach 2026

~444K records exposed

High

Prosura Data Breach 2026

300K-500K records exposed

High

Canvas (Instructure) Data Breach 2026

~275M (claimed) records exposed

Medium

Booking.com Data Breach 2026

Undisclosed records exposed

High

McGraw Hill Data Breach 2026

13.5M records exposed

High

Crunchyroll Data Breach 2026

Undisclosed records exposed

High

Eurail Data Breach 2026

300K+ records exposed

High

Basic-Fit Data Breach 2026

1M records exposed

High

Salesforce (ShinyHunters) Data Breach 2025

~1B records exposed

High

Allianz Life Data Breach 2025

2.8M records exposed

High

Workday Data Breach 2025

Undisclosed records exposed

Medium

Western Sydney University Data Breach 2025

10K records exposed

High

Genea Fertility Data Breach 2025

940K records exposed

Critical

DeepSeek Data Breach 2025

1M records exposed

Medium

Tangerine Telecom Data Breach 2024

232K records exposed

High

Australian Clinical Labs Data Breach 2022

223K records exposed

Critical

Qantas Data Breach 2025

5.7M records exposed

High

Optus Data Breach 2022

9.8M records exposed

Critical

Medibank Data Breach 2022

9.7M records exposed

Critical

Latitude Financial Data Breach 2023

14M records exposed

Critical

MyDeal (Woolworths) Data Breach 2022

2.2M records exposed

High
View all breach guides →

Disclaimer: This guide is provided for general informational purposes only and does not constitute legal, financial, or professional advice. The information is based on publicly available sources at the time of writing and may not reflect the most current developments. In The Event Of Pty Ltd (ABN 38 687 352 647) is not affiliated with Under Armour, Inc. If you believe you have been affected by this data breach, we recommend contacting the relevant authorities and seeking professional guidance specific to your circumstances.