Under Armour investigates breach that exposed customer emails and other profile data

Under Armour said it is investigating a data breach that appears to have exposed customer email addresses and other personal profile information, raising fresh concerns about how consumer brands secure large membership databases.

Reports about the incident indicated that the compromised information may include customer names and other account details such as birth dates, gender markers and ZIP codes. Under Armour said it had not found evidence that passwords or financial information were exposed and added that its primary website and payment processing systems were not impacted.

The breach was highlighted publicly by the cybersecurity site “Have I Been Pwned,” which tracks and verifies large troves of leaked credentials and personal data. Its operator said the absence of earlier public disclosure was notable given the dataset’s apparent size and the time that may have passed since the intrusion.

For consumers, the immediate risk from exposed emails and profile data often includes targeted phishing attempts and impersonation scams, especially when attackers can pair an email address with additional personal details that help messages seem legitimate.

For companies, incidents like this can create reputational damage, trigger regulatory scrutiny, and force a costly sequence of actions—from internal forensics and system hardening to customer notifications and monitoring support.

Under Armour said it is continuing to examine what happened and what information was involved, as the wider retail and consumer-tech world faces relentless pressure to treat account databases as high-value targets.