Under Armour Breach Exposes 72.7M Customer Records After Ransomware Extortion Attempt
What Happened — In November 2025 the Everest ransomware group claimed to have accessed ≈ 343 GB of Under Armour’s internal systems and demanded a ransom. In January 2026 the group published the stolen data on a public hacking forum, exposing 72,742,892 customer records that include names, email addresses, dates of birth, gender, geographic location, and purchase history.
Why It Matters for Trust & Control Assurance
- The incident demonstrates the need for continuous identity‑and‑access‑control monitoring to detect unauthorized activity before data is exfiltrated.
- It underscores the importance of maintaining auditable evidence of access‑policy enforcement and incident‑response actions for regulatory and audit readiness.
- A robust access‑control program provides the defensible trail required to satisfy multiple frameworks (e.g., NIST CSF, ISO 27001) when a breach occurs.
Who Is Affected
- Retail and e‑commerce companies that store consumer‑profile data.
Recommended Actions
- Conduct an immediate privileged‑access review and remediate any over‑privileged accounts.
- Deploy continuous user‑behavior analytics to flag anomalous access patterns.
- Document the incident‑response workflow and collect evidence to support audit inquiries.
Source: Have I Been Pwned – Under Armour breach
Technical Notes
- Attack vector: Not publicly disclosed; ransomware group claimed external compromise.
- Data types exposed: Names, email addresses, dates of birth, gender, geographic location, purchase history.
Source: Same as above