Under Armour investigates breach claims after reports of 72 million customer records exposed

What Under Armour says happened

Under Armour has said it is aware of claims that an unauthorized third party obtained certain customer data and that it is investigating the matter with external cybersecurity experts. The reports describe a large dataset tied to customers, with the scale often cited as roughly 72 million records.

In public statements cited in coverage, the company emphasized that it has not seen evidence the issue affected its main shopping website or the systems used to process payments or store customer passwords. That distinction matters because it speaks to immediate financial risk, but it does not eliminate the privacy and fraud concerns that can follow when personal data is exposed.

What data exposure can mean even without passwords

Even when passwords and payment data are not involved, stolen customer information can still be valuable for criminals. Email addresses can be used for targeted phishing, and combined personal details can help attackers craft convincing messages that trick people into revealing credentials elsewhere. Purchase-related data can also expose habits and locations, which increases the risk of social engineering.

Large breaches also tend to have a long tail. Consumers may not see immediate harm, but spam, fraud attempts, and account takeovers on unrelated services can appear weeks or months later—especially if criminals correlate data across multiple leaks.

Disclosure and consumer trust questions

Incidents of this size frequently renew debate about how quickly companies should notify affected customers and what level of detail they should provide. From a consumer standpoint, the most actionable information is often: what data types were exposed, how to verify whether you were affected, and what steps reduce risk now.

For brands, the reputational stakes can be high. Customers may accept that a company can be the victim of criminal hacking, but they are less forgiving when communications appear delayed or incomplete. Regulators and plaintiffs’ attorneys also scrutinize whether security controls and incident response procedures were adequate.

Practical steps for customers

If you have ever used an Under Armour account or received emails related to an Under Armour purchase, the safest approach is to assume your email could be targeted. Be cautious with messages that urge immediate action, especially those asking you to log in through an embedded link or provide personal details.

• Use unique passwords for important accounts; change reused passwords anywhere you have them.
• Enable two-factor authentication (2FA) on email and shopping accounts when available.
• Watch for phishing emails that reference real purchase details to build credibility.
• Consider an email alias strategy to reduce the impact of future leaks.