Under Armour data allegedly leaked by Everest ransomware group

• Ransomware group: Everest
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: November 17, 2025

Everest ransomware group claims Under Armour data leak

The Everest ransomware group has announced that it has published data belonging to the American sportswear company Under Armour on its dedicated leak site. According to the claims made by the threat actor, the data release is a direct consequence of the organization failing to meet specific ransom demands within a designated timeframe. The group asserts that the incident is tied to a timeline beginning on November 17, 2025.

In many modern ransomware campaigns, threat actors employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information before the encryption phase. If the victim refuses to pay the ransom to regain access to their systems, the attackers threaten to release the stolen data publicly to maximize pressure. By hosting data on a leak site, ransomware groups aim to damage the target's reputation and force compliance through the threat of public exposure.

Details of the claimed event

The Everest group has stated that the data associated with Under Armour has been released via links provided on their leak site. Furthermore, the group claims that the stolen information has not been limited to their own platform, alleging that the data has been duplicated and distributed across various hacker forums and various leak database sites. This widespread distribution is a common method used by cybercriminals to increase the visibility of the breach and heighten the pressure on the victimized organization.

The group has been known to be active since 2020, and their operational profile suggests a focus on targeting corporate structures through a combination of data theft and extortion methods. By spreading the data across multiple forums, they ensure that the information remains accessible to a wider audience of malicious actors, which can lead to secondary exploitation.

Information regarding the leaked data

While the Everest group has claimed to have published the information, they have not provided specific details regarding the nature or the content of the leaked data. The listing does not specify the volume of the data or the exact types of files that were allegedly exfiltrated. Consequently, the listing names no specific data types.

Impact and potential risks

The distribution of data on public forums and leak sites introduces several significant risks. One of the primary concerns is the potential for identity theft and targeted phishing attacks. When sensitive information is available to malicious actors, they can craft highly convincing social engineering campaigns aimed at employees or customers. These attacks often use the stolen context to gain further access to corporate networks or to defraud individuals.

Under Armour profile

Under Armour is an American company that specializes in the design, development, and marketing of sportswear, footwear, and accessories. It provides performance-oriented products for professional and amateur athletes worldwide.

Analysis and organizational implications

The actions taken by the Everest group may pose a significant risk of exposure for the organization's customer and employee data. Because Under Armour is a US-based entity, any confirmed data breaches could lead to complex legal proceedings under both state-level privacy laws and federal regulations. The intersection of data privacy laws and cyber extortion creates a difficult landscape for organizations attempting to manage the fallout of a breach.

For organizations operating in the retail and e-commerce sectors, such incidents highlight the importance of robust defensive measures. To mitigate the risks associated with data theft and extortion, companies often focus on implementing strong identity and access management, maintaining comprehensive logging and monitoring, and ensuring that data is encrypted both at rest and in transit. Furthermore, having a well-defined incident response plan is critical for managing the reputational and operational security challenges that arise when a group like Everest targets a corporate structure.

• Reputational Risk: Leaks can negatively impact the organization's public standing and consumer trust.
• Operational Security: The theft of internal data can compromise the long-term security of the organization's infrastructure.
• Legal and Regulatory Risk: Potential violations of privacy laws can result in significant legal consequences.