Under Armour investigates breach after reports say customer emails and profile details were exposed

Under Armour is investigating a data breach after reports indicated a large cache of customer information was exposed, including email addresses and other personal profile details. The company said it has not seen evidence that passwords or payment information were compromised, but the scale of the reported incident has raised questions about how widely the data may have circulated.

According to reporting on the breach, the dataset involved far more than a small test leak, with estimates suggesting information tied to tens of millions of customers. Details described as exposed include items like names and other basic attributes associated with customer accounts, though not the types of data that typically enable direct financial theft on their own.

Even when payment credentials are not included, leaked email addresses can still create significant risk by enabling phishing, account-takeover attempts, and targeted social engineering. Cybersecurity specialists often warn that attackers use such data to craft highly believable messages, particularly when a brand is well known and the message can reference a legitimate-looking service or order history.

The breach gained attention after the incident was surfaced by a well-known breach-notification service that aggregates leaked datasets to help people check whether their accounts appear in compromised collections. Reporting highlighted how unusual it can be for a breach of this reported magnitude to remain quiet for long, especially when it involves a consumer brand with a large customer base.

Under Armour said its main website and payment systems were not affected, suggesting the exposed data came from a different system or a historical database. For consumers, that distinction matters: it can limit the immediate financial fallout, but it does not eliminate downstream harm caused by the reuse of contact information across services.

Customers concerned about exposure should be cautious with password resets and “account verification” emails, using official channels rather than links in messages. For companies, the incident underscores how cybersecurity now functions as a core business issue—impacting reputation, customer trust, and potentially regulatory scrutiny—well beyond the immediate technical response.