TL;DR: The Everest ransomware group claimed it breached Under Armour in November 2025 and published customer data in January 2026. Have I Been Pwned added 72.7 million email addresses, along with names, dates of birth, genders, geographic locations and purchase details. Everest also claimed phone numbers, addresses and loyalty data, which HIBP did not confirm. Passwords and card numbers were not listed.
What happened
In November 2025 the Everest ransomware group listed Under Armour as a victim and tried to extort a ransom, claiming it had taken 343GB of data. Customer records were then published on a hacking forum in January 2026. Have I Been Pwned added the breach on 21 January 2026 with 72.7 million affected email addresses.
When The Register reported the leak, Under Armour had not acknowledged it or answered questions. Check for any notice the company has issued since, but don't wait for one before acting.
What data was exposed
Confirmed by Have I Been Pwned:
- Names and email addresses
- Dates of birth and genders
- Geographic locations
- Purchase details
Everest also claimed phone numbers, physical addresses, loyalty programme details and preferred stores. Treat those as possible, not confirmed. Passwords and payment card numbers were not listed.
Is this the MyFitnessPal breach?
No. Under Armour owned MyFitnessPal when that app was breached in 2018, which is why the two are often confused. That was a separate incident; see our page on the MyFitnessPal data breach.
How to check if you were affected
Run your email through a breach lookup; our free email exposure check includes this breach. If you've used more than one email for shopping, check each one.
What to do now
- Watch for targeted phishing. Your name, birthday, location and what you bought make fake order, refund and loyalty emails convincing. Go to the official site or app directly. See how to spot phishing.
- Change reused passwords. Even though passwords weren't listed, change any you reused with your Under Armour account; see what to do when a password leaks.
- Turn on two-factor authentication on your email first, since it's the key to everything else: how to set up 2FA.
- Be wary of birthday-based checks. A leaked date of birth weakens any account that uses it for verification. Consider a credit freeze if you're in the US.
Ransomware and customer data
Ransomware groups now steal data before encrypting systems, then leak it if the company won't pay. That means even companies that recover quickly can still expose customers. Retail has been hit hard; see the Hot Topic breach and the biggest data breaches in history.
Frequently Asked Questions
Was Under Armour hacked?
The Everest ransomware group claimed a breach in November 2025 and published customer data in January 2026. Have I Been Pwned added 72.7 million email addresses.
What data was leaked in the Under Armour breach?
Have I Been Pwned lists names, email addresses, dates of birth, genders, geographic locations and purchases. Everest also claimed phone numbers, addresses and loyalty data, which were not confirmed.
Were Under Armour passwords or card numbers leaked?
They were not listed among the data exposed by Have I Been Pwned.
Is the Under Armour breach the same as MyFitnessPal?
No. MyFitnessPal was breached in 2018 while owned by Under Armour. The Everest breach is a separate incident.
What should I do if my email is in the Under Armour breach?
Watch for phishing that uses your real details, change reused passwords, secure your email with two-factor authentication and consider a credit freeze.
Sources
- Have I Been Pwned: Under Armour data breach
- The Register: Everest ransomware gang said to be sitting on mountain of Under Armour data