Incident : data breach

UND3992039111825

Exposure Impact

Title: Under Armour Data Breach by Everest Ransomware Group

Description: The Everest ransomware group claimed responsibility for breaching Under Armour, posting a sample of stolen data (allegedly over millions of personal records and 343GB of internal company data) on a dark web leak site. The breach includes personally identifiable information (PII) of customers and employees, such as email addresses, phone numbers, order histories, location data, and transaction data. The group has given Under Armour a 7-day ultimatum to negotiate a ransom, threatening further data leaks if demands are not met.

Type: data breach

Threat Actor: Everest ransomware group

Motivation: financial (ransom extortion)

Incident : Data Breach

UND3492734111825

Exposure Impact

Title: Everest Ransomware Attack on Under Armour

Description: The Everest Ransomware group claimed responsibility for a massive data breach involving Under Armour, stealing 340 GB of sensitive data. The group demanded a ransom in Monero (XMR) with a seven-day deadline, threatening to sell the data on the dark web if unpaid. Compromised data includes personal identification information (email addresses, phone numbers, physical location data), sensitive documents (passport details, gender information, purchase histories), and internal company data (product SKUs, marketing, and sales data). The attack highlights potential security gaps in Under Armour's data handling practices.

Type: Data Breach

Threat Actor: Everest Ransomware Group

Motivation: Financial GainData Theft for Dark Web Sale

Incident : data breach UND3992039111825

Entity Name: Under Armour

Entity Type: retailer (sportswear manufacturer and retailer)

Industry: apparel and accessories

Location: United States (global operations)

Customers Affected: potentially thousands (exact number undisclosed)

Incident : Data Breach UND3492734111825

Entity Name: Under Armour

Entity Type: Corporation

Industry: Apparel/Retail

Location: United States

Size: Large (global enterprise)

Incident : data breach UND3992039111825

Type of Data Compromised: Pii (customers and employees), Internal company documents

Number of Records Exposed: millions (exact number undisclosed, 343GB of data exfiltrated)

Sensitivity of Data: high (includes personal and transactional data)

Personally Identifiable Information: email addressesphone numbersorder historieslocation datatransaction data

Incident : Data Breach UND3492734111825

Type of Data Compromised: Personal identification information (pii): email addresses, phone numbers, physical location data, Sensitive documents: passport details, gender information, purchase histories, Internal company data: product skus, marketing data, sales data

Sensitivity of Data: High (includes PII, passport details, and internal business data)

Incident : data breach UND3992039111825

Ransomware Strain: Everest

Data Exfiltration: True

Incident : Data Breach UND3492734111825

Ransom Demanded: {'currency': 'Monero (XMR)', 'amount': None, 'deadline': '7 days from announcement'}

Ransomware Strain: Everest Ransomware (evolved from BlackByte family)

Data Encryption: {'methods': ['AES (Advanced Encryption Standard)', 'DES (Data Encryption Standard)'], 'language': 'Russian (encryption code)'}

Data Exfiltration: True

Incident : Data Breach UND3492734111825

Lessons Learned: Ransomware groups are evolving with double extortion tactics (encryption + data theft)., Use of privacy-focused cryptocurrencies (e.g., Monero) complicates ransom tracing., Companies must reassess data storage practices, especially for highly sensitive PII (e.g., passport details)., Geopolitical motivations may influence target selection (e.g., avoidance of Russian-speaking regions)., Public silence post-breach can exacerbate reputational and operational risks.

Incident : data breach UND3992039111825

Recommendations: Customers should monitor accounts for suspicious activity (identity theft, fraud)., Use identity theft protection software if concerned., Exercise caution with unexpected communications (e.g., phishing emails/texts)., Verify sender authenticity (e.g., check for spoofed domains like 'gma1l' instead of 'gmail').Customers should monitor accounts for suspicious activity (identity theft, fraud)., Use identity theft protection software if concerned., Exercise caution with unexpected communications (e.g., phishing emails/texts)., Verify sender authenticity (e.g., check for spoofed domains like 'gma1l' instead of 'gmail').Customers should monitor accounts for suspicious activity (identity theft, fraud)., Use identity theft protection software if concerned., Exercise caution with unexpected communications (e.g., phishing emails/texts)., Verify sender authenticity (e.g., check for spoofed domains like 'gma1l' instead of 'gmail').Customers should monitor accounts for suspicious activity (identity theft, fraud)., Use identity theft protection software if concerned., Exercise caution with unexpected communications (e.g., phishing emails/texts)., Verify sender authenticity (e.g., check for spoofed domains like 'gma1l' instead of 'gmail').

Incident : Data Breach UND3492734111825

Recommendations: Implement robust encryption for stored sensitive data (e.g., PII, internal documents)., Adopt multi-layered ransomware defenses, including behavioral analysis and anomaly detection., Develop and test incident response plans specifically for double extortion scenarios., Monitor dark web for leaked data and proactively notify affected customers., Conduct third-party audits of data handling practices to identify unnecessary storage of high-risk information., Evaluate cryptocurrency transaction monitoring tools to detect ransom payments or dark web sales., Enhance employee training on phishing and social engineering, common initial access vectors for ransomware.Implement robust encryption for stored sensitive data (e.g., PII, internal documents)., Adopt multi-layered ransomware defenses, including behavioral analysis and anomaly detection., Develop and test incident response plans specifically for double extortion scenarios., Monitor dark web for leaked data and proactively notify affected customers., Conduct third-party audits of data handling practices to identify unnecessary storage of high-risk information., Evaluate cryptocurrency transaction monitoring tools to detect ransom payments or dark web sales., Enhance employee training on phishing and social engineering, common initial access vectors for ransomware.Implement robust encryption for stored sensitive data (e.g., PII, internal documents)., Adopt multi-layered ransomware defenses, including behavioral analysis and anomaly detection., Develop and test incident response plans specifically for double extortion scenarios., Monitor dark web for leaked data and proactively notify affected customers., Conduct third-party audits of data handling practices to identify unnecessary storage of high-risk information., Evaluate cryptocurrency transaction monitoring tools to detect ransom payments or dark web sales., Enhance employee training on phishing and social engineering, common initial access vectors for ransomware.Implement robust encryption for stored sensitive data (e.g., PII, internal documents)., Adopt multi-layered ransomware defenses, including behavioral analysis and anomaly detection., Develop and test incident response plans specifically for double extortion scenarios., Monitor dark web for leaked data and proactively notify affected customers., Conduct third-party audits of data handling practices to identify unnecessary storage of high-risk information., Evaluate cryptocurrency transaction monitoring tools to detect ransom payments or dark web sales., Enhance employee training on phishing and social engineering, common initial access vectors for ransomware.Implement robust encryption for stored sensitive data (e.g., PII, internal documents)., Adopt multi-layered ransomware defenses, including behavioral analysis and anomaly detection., Develop and test incident response plans specifically for double extortion scenarios., Monitor dark web for leaked data and proactively notify affected customers., Conduct third-party audits of data handling practices to identify unnecessary storage of high-risk information., Evaluate cryptocurrency transaction monitoring tools to detect ransom payments or dark web sales., Enhance employee training on phishing and social engineering, common initial access vectors for ransomware.Implement robust encryption for stored sensitive data (e.g., PII, internal documents)., Adopt multi-layered ransomware defenses, including behavioral analysis and anomaly detection., Develop and test incident response plans specifically for double extortion scenarios., Monitor dark web for leaked data and proactively notify affected customers., Conduct third-party audits of data handling practices to identify unnecessary storage of high-risk information., Evaluate cryptocurrency transaction monitoring tools to detect ransom payments or dark web sales., Enhance employee training on phishing and social engineering, common initial access vectors for ransomware.Implement robust encryption for stored sensitive data (e.g., PII, internal documents)., Adopt multi-layered ransomware defenses, including behavioral analysis and anomaly detection., Develop and test incident response plans specifically for double extortion scenarios., Monitor dark web for leaked data and proactively notify affected customers., Conduct third-party audits of data handling practices to identify unnecessary storage of high-risk information., Evaluate cryptocurrency transaction monitoring tools to detect ransom payments or dark web sales., Enhance employee training on phishing and social engineering, common initial access vectors for ransomware.

Incident : data breach UND3992039111825

Source: TechRadar Pro

Incident : data breach UND3992039111825

Source: Cybernews

Incident : Data Breach UND3492734111825

Source: Cybersecurity News Report (hypothetical, based on incident description)

Incident : data breach UND3992039111825

Investigation Status: unconfirmed (Under Armour has not publicly responded)

Incident : Data Breach UND3492734111825

Investigation Status: Ongoing (no public confirmation or details from Under Armour as of report)

Incident : data breach UND3992039111825

Customer Advisories: Monitor accounts for fraud/identity theft.Be wary of social engineering attempts (e.g., phishing).

Incident : data breach UND3992039111825

High Value Targets: Customer Pii, Internal Company Documents,

Data Sold on Dark Web: Customer Pii, Internal Company Documents,

Incident : Data Breach UND3492734111825

High Value Targets: Customer Databases, Internal Marketing/Sales Data,

Data Sold on Dark Web: Customer Databases, Internal Marketing/Sales Data,

Incident : Data Breach UND3492734111825

Root Causes: Potential Inadequate Data Encryption Or Access Controls For Sensitive Pii., Possible Lack Of Segmentation Between Customer Data And Internal Business Systems., Unclear Initial Access Vector (E.G., Phishing, Unpatched Vulnerability, Or Insider Threat).,