Under Armour Data Breach Lawsuit: Case Survives, Now Paused for Mediation
Questions about this case?
AI Legal Assistant · free · answers in seconds · general information, not legal advice
In November 2025 the Everest ransomware gang claimed it had taken 343 GB of Under Armour data; in January 2026 a customer file with 72.7 million email addresses surfaced on a hacking forum. The federal class action lawsuit Under Armour faces in Maryland survived a motion to dismiss on September 11, 2026, and on September 21, 2026 the judge paused it so the parties can mediate. As of October 12, 2026 there is no Under Armour settlement, no fund, no claim form and no deadline.
Editorially Reviewed — Content reviewed for accuracy using published legal research, government data, and verified court records. See our methodology
Reviewed by Leonard Goldberg, Editor · Last updated
What the Lawsuit Says Happened
According to the complaints, an unauthorized party got into Under Armour's systems on or around November 17, 2025. Everest claimed responsibility, said it had stolen 343 GB of internal data and gave the company seven days to make contact. The lawsuit alleges Under Armour did not pay and the data was leaked.
Have I Been Pwned, which loaded the leaked file, counts 72.7 million affected email addresses, many with names, dates of birth, genders, locations and purchase information. Security firm Malwarebytes reported the file holds 191,577,365 records with 72,727,245 unique email addresses. The consolidated complaint alleges more: phone numbers, passport information, store preferences and browsing histories. Those extra fields are allegations, not findings.
The plaintiffs plead negligence, breach of contract, breach of fiduciary duty, unjust enrichment and a Maryland Consumer Protection Act claim. They also allege Under Armour never sent breach notices to the people affected.
Case Details
The case is In re Under Armour, Inc. Data Incident Litigation, No. 1:25-cv-03857 in the U.S. District Court for the District of Maryland, before Judge Stephanie A. Gallagher. It began as Malone v. Under Armour, Inc., filed November 24, 2025 by a former employee.
On February 4, 2026 the court merged it with Freifeld v. Under Armour, Inc. (No. 1:25-cv-03871) and Ganesh v. Under Armour, Inc. (No. 1:25-cv-04106). On February 11, 2026 four more suits were folded in (Nos. 26-cv-00332, 26-cv-00427, 26-cv-00474 and 26-cv-00486). Eight customers and former employees filed one consolidated complaint on March 6, 2026. You can read the September 11, 2026 opinion on CourtListener.
Status: Stayed for Mediation, No Settlement
Ten days later, on September 21, 2026, she granted a joint motion to stay the case. The order tells the parties to report by January 15, 2027 on the mediation and “any potential resolution.”
Mediation can end in a deal or in nothing. As of October 12, 2026 no Under Armour settlement has been announced. There is no fund, no administrator, no claim form and no deadline.
Follow this case
There's no claim deadline yet. We'll email you if a settlement opens a claim period.
Who Is in the Proposed Class
The consolidated complaint proposes a nationwide class of people whose information was exposed in the breach, plus a Maryland subclass. That covers both customers and current or former employees. No class has been certified yet.
How to check: enter your email address at Have I Been Pwned's Under Armour entry. If your address is listed, you are very likely in the proposed class. Keep a screenshot.
Do not wait for a letter. The lawsuit alleges Under Armour has not sent notices to the people affected. If a settlement happens, a court-appointed administrator will publish the claim process and set a deadline. You do not need to sign up for anything now.
What a Case Like This Pays
For context only, not a prediction: data-breach settlements usually combine reimbursement of documented losses, a small flat payment for everyone else, and sometimes credit monitoring. With a class of tens of millions, a flat share tends to be small. Documented losses carry more weight. Some named plaintiffs here allege a fraudulent debit-card charge and a bank account opened in their name. If something like that happened to you, save the records now. Our data breach settlement calculator shows what comparable cases have paid.
How cases like this one end
Our copy of the federal courts’ own case database covers 129,730 other contract casesclosed in U.S. federal district courts between 2015 and 2026, 6% of them filed as class actions:
- 30.7% ended in a settlement recorded by the court. Another 20.2% were dismissed voluntarily, which often follows a private settlement — so the real settlement share sits between 30.7% and 50.9%.
- 7.5% were decided on a motion before any trial.
- 1 in 72 reached a trial (1.4%), after a median of 29.3 months.
- Median time from filing to the end of the case: 7.6 months.
- Only 7,691 of them (5.9%) record a money award at all; the median of those is $407,000.
These are base rates for this type of case (federal other contract cases) — not a prediction about this lawsuit, and not legal advice. Source: Federal Judicial Center, Integrated Database (civil), analysed by Settlement Insight. Cases heard in state courts are not included.
Under Armour Data Breach Timeline
- 1
November 2025 — Everest Claims the Attack
Per the complaints, the intrusion happened on or around November 17, 2025. Everest posts Under Armour on its leak site, claims 343 GB of data and sets a seven-day deadline.
- 2
November 24, 2025 — First Lawsuits
Malone (1:25-cv-03857) and Freifeld (1:25-cv-03871) are filed in federal court in Maryland. Ganesh (1:25-cv-04106) follows on December 12, 2025.
- 3
January 18, 2026 — Data Leaked
An Everest member posts the data on a cybercrime forum. Have I Been Pwned adds 72.7 million affected email addresses.
- 4
February–March 2026 — One Consolidated Case
On February 4 and 11, 2026, Judge Gallagher merges seven suits under the Malone case number. Eight plaintiffs file a consolidated complaint on March 6, 2026.
- 5
September 11, 2026 — Motion to Dismiss Mostly Denied
The fiduciary-duty claim is dismissed without prejudice. Negligence, contract, unjust enrichment and the Maryland consumer-protection claim proceed.
- 6
September 21, 2026 — Stayed for Mediation
The court pauses the case at both sides' request. A status report on the mediation is due January 15, 2027. No settlement has been announced.
Three Things to Watch For
The leaked file includes names, emails, birth dates, locations and purchase history, which makes Under Armour lures easy to personalize:
“Claim your Under Armour settlement” pages
There is no claim form, because there is no settlement. A site asking for your Social Security number, bank details or a fee to “reserve your payment” is collecting data, not filing a claim.
Emails that quote your past orders
The leaked data contains purchase information, so a fake “order problem,” “loyalty reward” or “password reset” email can name products you actually bought. Go to the Under Armour site directly instead of clicking the link.
“You are owed part of the $434 million”
That money comes from a 2024 deal with stock investors, not from the data breach. A breach victim who did not buy Under Armour stock between 2015 and 2019 has no share of it, so anyone asking for a fee to collect one is lying.
Under Armour Data Breach — Questions People Actually Ask
Is there an Under Armour data breach settlement?
Not as of October 12, 2026. The case was stayed on September 21, 2026 so the parties can mediate, and a status report is due January 15, 2027. Until a settlement is announced and approved by the court, there is no fund, claim form or deadline.
What was the amount of the payout in the Under Armour class action?
The $434 million figure is from a different Under Armour class action. In June 2024 the company agreed to pay that amount to settle In re Under Armour Securities Litigation (No. 17-cv-00388), brought by people who bought Class A or Class C stock between September 16, 2015 and November 1, 2019. That case has nothing to do with the data breach, and nothing has been paid in the breach case.
How do I know if my data was in the Under Armour data breach?
Check your email address on Have I Been Pwned, which lists 72.7 million affected addresses. The lawsuit alleges Under Armour has not notified the people affected, so not getting a letter does not mean you were left out.
What information was exposed?
Have I Been Pwned confirms email addresses, names, dates of birth, genders, locations and purchase information. The attackers and the lawsuit claim phone numbers, addresses, loyalty details and passport information as well. Those are claims, not confirmed facts. Payment cards and passwords are not among the fields Have I Been Pwned lists.
What did the judge decide in the Under Armour lawsuit?
On September 11, 2026 Judge Stephanie A. Gallagher granted Under Armour's motion to dismiss in part and denied it in part. She dismissed the fiduciary-duty claim without prejudice and let the other four claims proceed to discovery. That ruling does not decide who is right.
How much compensation will I get for a data breach?
In this case, nothing is set and nothing is payable. Breach settlements typically pay more to people who can document out-of-pocket losses or fraud than the flat amount everyone else gets. Keep records of any fraud, bank fees or time spent, and see our open settlements list for breach cases you can claim in today.
What was the Under Armour scandal?
People usually mean one of two older matters. In the investor case, shareholders alleged the company overstated consumer demand from 2015 to 2016, and it later agreed to the $434 million settlement. In the other, Under Armour disclosed on March 29, 2018 that 150 million MyFitnessPal accounts had been breached. Neither one is the November 2025 breach, and this page does not cover claims in either.
What should I do right now?
Change your Under Armour password, plus any other account where you used the same one, and turn on two-factor authentication. Be suspicious of emails about your orders. Freezing your credit is free and makes it harder to open accounts in your name. Do not pay anyone to “join” the Under Armour class action. There is nothing to join.
Separate from this case: were you injured in the last 2 years?
Class-action payouts are fixed amounts through an administrator. A personal injury claim is a different case — and often worth far more. Free estimate, no obligation.
Related Consumer Brand Lawsuits
Open Class Action Settlements
Settlements you can file a claim in right now, with deadlines
Data Breach Settlement Calculator
What comparable breach settlements have paid per person
Class Action Payout Calculator
Estimate a per-person share once a fund and class size exist
Hertz Data Breach
Another consumer-brand breach and where its lawsuits stand