Under Armour investigates breach reportedly affecting tens of millions of customer records

Under Armour is investigating a reported data breach that exposed customer email addresses and other personal details for a large number of users, according to the Associated Press. The breach drew attention after being flagged by the “Have I Been Pwned” service, which tracks compromised accounts. ([apnews.com](https://apnews.com/article/6155a46363679c28af4d612ad3f23e36?utm_source=openai))

The company said it has not found evidence that passwords or financial information were exposed, and indicated that its primary website and payment systems were not compromised. Even so, the scale of the data reportedly involved has raised questions about downstream risks such as targeted phishing campaigns. ([apnews.com](https://apnews.com/article/6155a46363679c28af4d612ad3f23e36?utm_source=openai))

Reports indicate the exposed information may include email addresses and additional profile fields such as names, birthdates, gender, and ZIP codes—data that can be valuable for criminals attempting account takeovers on other services through social engineering, credential-stuffing, or identity-based scams. ([apnews.com](https://apnews.com/article/6155a46363679c28af4d612ad3f23e36?utm_source=openai))

The incident is also a case study in breach detection timelines. AP reported that the compromise may have occurred in late 2025, and noted commentary questioning why a public disclosure had not appeared sooner given the apparent size of the dataset. ([apnews.com](https://apnews.com/article/6155a46363679c28af4d612ad3f23e36?utm_source=openai))

Under Armour said it is reviewing the matter and assessing impacts, a process that typically involves log analysis, forensics, and determining whether attackers had ongoing access. Companies also must determine which jurisdictions’ notification rules apply, since breach disclosure requirements can vary by state and country. ([apnews.com](https://apnews.com/article/6155a46363679c28af4d612ad3f23e36?utm_source=openai))

For customers, the practical risk often shows up after the headlines fade: credible-looking emails that reference personal details, password reset scams, or messages that imitate customer support. Security experts generally recommend unique passwords, password managers, and multi-factor authentication wherever available. ([apnews.com](https://apnews.com/article/6155a46363679c28af4d612ad3f23e36?utm_source=openai))

The case is the latest reminder that consumer brands can become attractive targets because of the sheer volume of accounts they hold. Even when payment data is untouched, large-scale exposure of contact information can still generate long-lived fraud risk, especially when combined with other leaks circulating online. ([apnews.com](https://apnews.com/article/6155a46363679c28af4d612ad3f23e36?utm_source=openai))

As the investigation continues, key open questions include how attackers accessed the data, whether third-party vendors were involved, and what remediation steps will be required to prevent recurrence. ([apnews.com](https://apnews.com/article/6155a46363679c28af4d612ad3f23e36?utm_source=openai))