Under Armour Data Breach Exposed Millions of Records, Lawsuit Says

Case Overview: The lawsuit accuses Under Armour of failing to secure data stolen in a massive 2025 breach.

Consumers Affected: Millions of customers and employees with exposed personal information.

Court: U.S. District Court for the District of Maryland

Under Armour has failed to protect the personal information of millions of people, a new lawsuit alleges, after a massive November breach exposed customer and employee data to a notorious ransomware group. 

The proposed class action lawsuit claims the company stored highly sensitive information on inadequately secured systems and ignored well-established industry standards designed to prevent this very type of cyberattack. 

Around November 17, 2025, hacker group Everest allegedly infiltrated Under Armour’s network and later boasted on its leak site that it stole more than 343 gigabytes of internal documents, employee files, and personal data belonging to millions of individuals worldwide. 

Everest also uploaded sample files and issued public demands, giving Under Armour a deadline to respond before it would release more data.

The lawsuit alleges that the stolen information includes names, email addresses, phone numbers, account identifiers, and other sensitive consumer and employee details, much of it unencrypted. 

Former Employee Says Company Failed to Protect Sensitive Information

Milreace Malone of Baltimore, a former Under Armour employee, filed the lawsuit after he says the company required him to hand over sensitive personal information as a condition of employment. 

He alleges he took precautions to safeguard his own data but trusted Under Armour to meet its obligation to store it securely.

Malone says he has spent significant time monitoring his accounts and attempting to limit the fallout from the breach. The complaint outlines a range of issues he has already experienced, including loss of privacy, diminished value of personal data, time spent on mitigation efforts, and heightened anxiety, and argues he now faces an ongoing risk of identity theft and fraud.

Because Under Armour retained unencrypted copies of his information, the lawsuit says, that risk will continue indefinitely.

Everest Ransomware Group Claims Responsibility for the Attack

Under Armour failed to meet basic cybersecurity standards, according to the lawsuit, which points to guidance from the Federal Trade Commission and widely accepted industry frameworks. 

Malone alleges Under Armour lacked essential protections such as encryption, multi-factor authentication, proper network monitoring, and staff training, leaving its systems vulnerable to exactly the kind of attack launched by Everest.

The lawsuit also says that Under Armour has not publicly disclosed details of the breach and claims that sensitive information is now circulating on the dark web, where criminals can exploit or sell it.

Cybersecurity Lapses Trigger Lawsuits Across Multiple Industries

Under Armour is far from the only major brand under scrutiny for alleged data-security lapses. Cohen’s Fashion Optical is facing litigation after a ransomware group reportedly accessed unencrypted Social Security numbers and health-related data. 

Meanwhile, Major League Baseball is accused of failing to protect users of its digital ticketing platform, and Union Home Mortgage, Allianz Life Insurance, Victoria’s Secret, Cooper University Health Care, and Globe Life are all defending lawsuits tied to recent breaches.

In the Under Armour data breach class action lawsuit, Malone wants to represent everyone in the United States whose information was accessed during the breach. The lawsuit argues that Under Armour acted negligently and violated multiple state and federal laws. 

He is asking the court to order stronger data-protection measures, prevent future breaches, and award damages, fees, and other relief. 

Case Details

• Lawsuit: Malone v. Under Armour, Inc. 
• Case Number: 1:25-cv-03857-EA 
• Court: U.S. District Court for the District of Maryland 

Plaintiffs' Attorney:

• Leanna A. Loginov (Shamis & Gentile, P.A.)

Were you affected by the Under Armour data breach? Share what you’ve experienced in the comments below.