\n<\/p>\n
Clothing and fitness data company Under Armour said it is investigating claims of a data breach after a cybercriminal posted millions of customer records to a hacker forum.<\/p>\n
The seller told TechCrunch that the data was taken in a November data breach, which the Everest ransomware gang claimed responsibility for in a post on its dark web leak site at the time.\u00a0<\/p>\n
News of the data theft became more widely known this week after breach notification site Have I Been Pwned obtained a copy of the stolen data, and notified 72 million individuals by email that their information had been compromised.<\/p>\n
Have I Been Pwned said the stolen Under Armour dataset included names, email addresses, genders, dates of birth, and customers\u2019 approximate location based on postcode or ZIP code. The data also included information relating to purchases.<\/p>\n
The seller provided TechCrunch with a sample of the stolen data, which appears to contain millions of records of Under Armour customer purchases and matched the types of data that Have I Been Pwned had reported. The stolen data contains reams of email addresses belonging to Under Armour employees.<\/p>\n
When reached for comment, Under Armour spokesperson Matt Dornic told TechCrunch that the company is \u201caware of claims that an unauthorized third party obtained certain data.\u201d<\/p>\n
\u201cOur investigation of this issue, with the assistance of external cybersecurity experts, is ongoing. Importantly, at this time, there\u2019s no evidence to suggest this issue affected UA.com or systems used to process payments or store customer passwords,\u201d the spokesperson added.<\/p>\n
\u201cWhat we know at this time is the number of affected customers with any sort of information that could be considered sensitive is a very small percentage,\u201d said Dornic.\u00a0<\/p>\n
The spokesperson did not immediately respond to a follow-up email asking what types of customers\u2019 information Under Armour considers \u201csensitive\u201d information, nor did he provide an accurate figure of how many customers are affected by the breach.<\/p>\n
\u201cAny implication that sensitive personal information of tens of millions of customers has been compromised is unfounded,\u201d the spokesperson said.<\/p>\n
Under Armour did not say if it planned to notify customers whose information was compromised. It did not say if it had received any correspondence from the hackers, such as a demand for ransom.<\/p>\n<\/div>\n