Varsity Brands varsity.com Varsity Brands data breach: what happened and what to do
Varsity Brands said an intruder accessed some of its files on 22 May 2024. About 65,669 people were notified in October 2024. Names, Social Security numbers, dates of birth, financial account details and employee IDs may be involved.
View all 13,115 breaches- Breach date
- 22 May 2024
- Made public
- 14 Oct 2024
- Affected
- 65,669
- Data exposed
- Names, Social security numbers, Dates of birth, Bank account numbers
- Last updated
What happened
Varsity Brands is the Tennessee-based maker of cheerleading uniforms and gear, and the parent of Varsity Spirit. The company told regulators and customers in October 2024 that an intruder had gained access to some of its files on 22 May 2024. Press coverage of the filings says the intrusion was detected two days later and that notices went out on 14 October 2024. A filing with the Maine Attorney General lists 65,669 people affected in total, so reports round it to about 65,000.
Varsity has not confirmed ransomware, and no group has claimed the attack in press coverage. The company did say the intruder reached a small subset of files that contained personal information.
What was exposed
The notice described "names or other personal identifiers". The company later told a news outlet the files potentially included names, Social Security numbers, dates of birth, financial account information and employee IDs. What a given person lost varies, so read the letter you received for your own list.
Because the files included cheer athletes' families, employees and customers, many of the people notified are parents who bought gear or registered a child for events.
What Varsity offered
Affected people were offered 24 months of free credit monitoring and identity theft protection. A class action was filed after the notices went out, with the plaintiffs arguing the notice came late.
What it means for you
If your Social Security number or bank account details were in the files, the risk lasts years, not weeks. Freeze credit for yourself and for any child whose details may be included, and take the monitoring offer.
What to do if you were in it
- 1
Freeze credit for you and your kids
Place a free freeze at Equifax, Experian and TransUnion. If a child's Social Security number may be involved, each bureau also lets a parent freeze a child's file.
- 2
Take the free monitoring
Varsity offered 24 months of credit monitoring and identity theft protection. The enrollment steps are in the notice letter.
- 3
Watch your bank accounts
If financial account details were involved, review statements and ask your bank about added fraud alerts or new account numbers.
- 4
Expect phishing that mentions the breach
Fake 'Varsity' emails and calls about your data or a refund are common after a notice. Use only the contact details in your official letter.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It checks breach databases and the dark web for your email and phone number and tells you which leaks include them, so you know which passwords to change first.
Frequently asked
How many people were affected by the Varsity Brands breach?
A filing with the Maine Attorney General lists 65,669 people in total, as reported by security news outlets.
What was exposed?
Names or other personal identifiers. The company later said files potentially included Social Security numbers, dates of birth, financial account information and employee IDs.
Is there a Varsity Brands settlement?
A class action was filed after the notices. No settlement has been reported.
Was it ransomware?
Varsity has not confirmed ransomware, and no group has claimed it in press coverage.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
