Lapsus$ Claims Breach of Adidas Extranet, But Scope Remains Disputed The hacking group Lapsus$ has claimed responsibility for breaching the Adidas Extranet a secure portal used by the company’s business partners, suppliers, and employees allegedly exposing around 815,000 rows of data. The compromised information reportedly includes usernames, passwords, and technical details, though only 130 accounts appear to have been directly affected. Lapsus$ suggested the breach was part of a larger operation, hinting at an upcoming "something bigger." However, cybersecurity researchers at Cybernews dispute the severity of the incident, arguing that the group exaggerated its impact. The leaked data, they say, primarily originates from Double D, a French Adidas licensee specializing in combat sports, rather than Adidas itself. The exposed records include personal details such as names, email addresses, passwords, birthdates, and company information. While Lapsus$ is considered one of the most active English-speaking cybercrime groups alongside Scattered Spider and ShinyHunters analysts note that the breach may have been inflated for notoriety. The group also claimed to possess 420GB of Adidas-related data tied to the French market, though researchers found the dataset included irrelevant entries, such as SQL commands. Adidas confirmed a third-party breach in May 2025, though the connection to this incident remains unclear. The potential for phishing attacks using the leaked data persists, but experts caution against overstating the breach’s scale.