‘Preventable’ Nike Data Breach Sparks Class Action Lawsuit

New to ClassAction.org? Read our Newswire Disclaimer

Nike, Inc. has been hit with a proposed class action lawsuit alleging that the athleticwear and shoe company failed to protect sensitive consumer information from a data breach discovered in January 2026.

Get class action lawsuit and class action settlement news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter.

The 41-page data breach lawsuit asserts that Nike’s failure to implement reasonable cybersecurity measures allowed an unauthorized party to access the company’s files through a portal hosted by a third-party service provider. According to the case, the “massive and preventable” data breach, which was discovered by Nike on January 21, 2026, has subjected victims to an “increased risk of suffering,” including harm from identity theft and fraud.

According to widespread media reports, the notorious hacking group Worldleaks, formerly known as Hunters International, may have been responsible for the January 2026 Nike data breach and claimed to have extracted approximately 1.4 terabytes of sensitive data. Per the lawsuit, consumer names, email addresses, billing addresses, phone numbers, transaction information and payment card details were compromised in the breach.

The filing says that consumers were required to provide personal information to Nike to purchase its products and that Nike knew or should have known of the substantial risks associated with storing sensitive data. Nike, the suit claims, “failed to spend sufficient resources” on cybersecurity measures, such as the encryption of sensitive personal data, prevention of external access and employee training.

The filing further explains that the Federal Trade Commission (FTC) has published numerous cybersecurity guidelines to help businesses protect confidential information, including by properly disposing of personal information that is no longer needed, understanding network vulnerabilities, implementing policies to correct any security issues, and using intrusion detection systems, among other recommendations. According to the case, Nike failed to implement these “basic data security practices.”

The plaintiff and class members now face an increased risk of misuse of their personal data, the case says, claiming the stolen information will likely be used for a variety of “sordid” purposes, such as identity theft and fraud. Once information has been dumped onto the dark web, criminals will use and trade the wrongfully obtained information on the black market for years, the filing states.

Per the case, “[t]hese risks are both certainly impending and substantial,” and victims of identity theft and fraud will be forced to spend “many hours and large amounts of money” to address the resulting harms.

Essentially, Nike’s “[m]any failures laid the groundwork for the success (‘success’ from a cybercriminal’s viewpoint) of the Data Breach,” the lawsuit contends.

The plaintiff claims that she is “very careful” with her personally identifiable information and would not have entrusted Nike with it had she known of the company’s negligent and reckless cybersecurity policies. Moreover, the plaintiff claims she did not receive notice of the data breach until “several weeks” after it was discovered, via a notice dated February 25, 2026. Per the case, this delay “further exacerbated” the harm to the plaintiff and other data breach victims.

The Nike data breach class action lawsuit seeks to cover all United States residents whose private information was compromised as a result of the data breach.

Learn all about the legal process: What is a class action lawsuit?