Under Armour ransomware breach: data of 72 million customers appears on the dark web

Under Armour’s ransomware breach has escalated, with the Everest Group leak site indicating that data from the incident is now circulating online. The data set is said to contain 191,577,365 records, including 72,727,245 unique email addresses, and is presented as part of a claim by the Everest Group that full data publication occurred after negotiations ended. The breach is linked to a November 2025 attack, and the Everest leak site asserts that data was duplicated across various hacker forums and leak databases.

The article notes mounting evidence that a large customer dataset is in the wild, though it frames certain attacker claims as potentially exaggerated and stresses that lawsuits alleged negligence in protecting sensitive information. The piece, authored by Pieter Arntz, was published on 22 January 2026.