Under Armour Data Breach Lawsuit Claims Co. Failed to Protect Sensitive Info from November 2025 Incident

New to ClassAction.org? Read our Newswire Disclaimer

Under Armour faces a proposed class action lawsuit after cybercriminals in November 2025 stole hundreds of gigabytes of sensitive data, including the personal information of millions from around the world, and leaked it on the dark web.

Get class action lawsuit and class action settlement news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter.

According to the 40-page Under Armour data breach lawsuit, the company collects and obtains the private information of millions of individuals who either shop on its site, are employed by the company, or have some degree of affiliation with the retailer. For this reason, the athletic apparel company has certain “legal and equitable duties” to safeguard this personal information, and individuals reasonably expect that the company will not disclose their names, contact details, payment information, and other sensitive data, the case says.

The complaint relays, however, that a known cybercriminal group called Everest was able to hack into Under Armour’s systems and reportedly obtain 343 gigabytes of internal company data last month. Everest was able to pull off this massive data breach because Under Armour negligently “failed to meet the minimum standards” in cybersecurity protection that may have made the incident largely preventable, the lawsuit contends.

Related Reading: Data Breach Class Action Lawsuits

The complaint relays that Federal Trade Commission guidelines advise businesses to “properly dispose of personal information that is no longer needed; encrypt information stored on computer networks; understand their network’s vulnerabilities; and implement policies to correct any security problems.”

According to the suit, Under Armour not only failed to properly safeguard the sensitive information in its care but also failed to timely notify proposed class members about the Under Armour data breach.

“In breaching its duties to properly safeguard Plaintiff’s and Class Members’ Private Information and give them timely, adequate notice of the Data Breach’s occurrence, Defendant’s conduct amounts to negligence and/or recklessness and violates federal and state statutes as well as its own internal privacy policies,” the suit asserts.

As a result of the Under Armour data breach, class members can experience purportedly diminished value of their privacy, exposure of private information, monetary losses, anxiety, and emotional distress, per the complaint.

The plaintiff, a Maryland resident, is a former Under Armour employee who entrusted the company with his personal information and expected that it would be reasonably protected. Because of the data breach, the suit relays, the plaintiff has spent “significant time” on mitigation efforts to protect and monitor his accounts in light of the continued, increased risk that his information may be in the hands of unauthorized parties or on the dark web.

“Defendant failed to adequately protect Plaintiff’s and Class Members’ Private Information––and failed to even encrypt or redact this highly sensitive information,” the complaint alleges. “This unencrypted, unredacted Private Information was compromised due to Defendant’s negligent and/or careless acts and omissions and their utter failure to protect Plaintiff’s and Class Members’ sensitive data.”

The Under Armour data breach class action lawsuit looks to cover all United States residents whose private information was accessed and/or obtained by an unauthorized party as a result of the November 2025 data breach.

Check out ClassAction.org’s lawsuit list for current class action lawsuits.