Under Armour underarmour.com Under Armour data breach: what happened and what to do
Have I Been Pwned lists 72,742,892 Under Armour accounts from a breach dated November 2025, with names, email addresses, dates of birth, genders, locations and purchases. Under Armour said it found no sign of passwords or payment data being affected.
View all 13,115 breaches- Breach date
- 17 Nov 2025
- Affected
- 72,742,892
- Data exposed
- Dates of birth, Email addresses, Genders, Geographic locations, Names, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In January 2026, Have I Been Pwned (HIBP) added a data set of 72,742,892 accounts tied to Under Armour, the sports apparel brand. HIBP dates the breach to 17 November 2025 and added it on 21 January 2026.
The Associated Press reported that Under Armour was looking into the breach. The company said it had no evidence that UA.com or the systems that process payments or store customer passwords were affected. It called the suggestion that sensitive data for tens of millions of customers had been compromised "unfounded". Troy Hunt, who runs HIBP, said he agreed with that assessment based on what had emerged so far. He also said he was surprised the company hadn't put out a formal disclosure.
So the picture is this. The data set exists and HIBP verified it. The company disputes how serious it is. Neither side has published a detailed account of how the data was taken.
What was exposed
HIBP lists six types of data: names, email addresses, dates of birth, genders, geographic locations and purchases. Coverage of the breach adds that some records included ZIP codes. Passwords and payment card details aren't in the list.
Purchase history is the unusual one. It shows what a person bought from the brand, which says something about their hobbies and spending. In the wrong hands that makes a fake order email more convincing.
What criminals can do with it
A name, email address and date of birth together are the kind of detail used to answer "verify your identity" questions on a phone call or a chat. They also make phishing believable. A message that quotes your real name and says there's a problem with an Under Armour order will get opened.
Don't panic about financial fraud. Without passwords or card numbers, the direct risk to your money is low. The risk is social: scams that borrow your details and seem to come from a brand you know.
The company's response
Under Armour said it had no evidence that UA.com or its payment and password systems were affected, and called claims of a broad compromise unfounded. It hadn't issued a detailed notice when the AP story ran. If you get an email from the company about this breach, don't click links in it. Go to the company's website yourself.
What you can do
The data can't be taken back from the people who hold it. You can make it less useful. Treat unexpected mail about an Under Armour order with suspicion, and keep your password for the account unique.
It's also worth knowing that a company disputing the severity of a breach doesn't make the data set go away. HIBP's entry is live, and the records in it are real accounts. Whether or not Under Armour ever publishes a full account, your own habits, such as unique passwords and a pause before clicking, are the part you control.
What to do if you were in it
- 1
Be skeptical of Under Armour emails and texts
Fake order problems and refund messages are the obvious use of this data. Open the brand's app or website yourself rather than clicking a link.
- 2
Use a unique password for your account
Passwords weren't listed, but if the one you used for Under Armour matches another account, change it. A password manager makes that easy.
- 3
Don't confirm your details to callers or chat agents
Name, birth date and purchases are the sort of facts a scammer uses to sound legitimate. If someone contacts you first, hang up and call the number on the company's website.
- 4
Check your card statements for the usual things
Payment data wasn't listed, but a quick look at your statement for charges you don't recognize takes a minute.
- 5
Check whether your email or phone number is in this and other breaches
A free scan from Serus shows which breaches include your email or phone number. Serus monitors breach databases and the dark web and alerts you when your data shows up. It can't remove data from a breach, so the alert tells you what to change.
Frequently asked
Was I affected by the Under Armour data breach?
Search your email address on Have I Been Pwned. It lists 72,742,892 accounts.
What was exposed?
HIBP lists names, email addresses, dates of birth, genders, geographic locations and purchases. Some records also had ZIP codes, according to the Associated Press.
Were passwords or payment cards taken?
Neither is on HIBP's list. Under Armour said it had no evidence payment systems or customer password systems were affected.
Has Under Armour confirmed the breach?
It said it was looking into it and disputed claims of a broad compromise. Check the company's website for any formal notice.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
