A stolen password is not the only useful outcome of a data breach. Names, email addresses, location details and purchase history can make an impersonation attempt appear familiar and credible. The Under Armour incident illustrates how ordinary consumer data can become the starting point for more targeted fraud.
Have I Been Pwned lists about 72.7 million email addresses in a dataset associated with a November 2025 incident and published in January 2026. Its listing identifies names, dates of birth, genders, geographic locations and purchase information among the data types represented.
Under Armour said in January 2026 that it was investigating the claims and had no evidence at that point that its main website, payment processing systems or customer password storage were affected. The company also disputed suggestions that sensitive information of tens of millions of customers had been compromised. Those distinctions matter: an address count in a published dataset is not proof that every associated individual suffered identical exposure.
What information was reported?
The breach listing identifies email addresses and several kinds of personal and transaction context. The exact exposure for any individual record may differ.
There is no need to invent additional compromised fields to explain the risk. A message sent to a real address that includes an accurate name, location or purchase detail is already more persuasive than generic spam.
How can nonfinancial data be misused?
Someone with purchase information can write a convincing account, refund or delivery message. Geographic details can be used to tailor contact. Names and associated email addresses help link records across platforms or impersonate a legitimate service provider.
A customer who also holds a senior position may face a second order risk. Consumer details can be combined with publicly available employment, family or professional information to create a more tailored approach against the individual or their organization.
This does not establish that criminals used the Under Armour dataset for a particular attack. It explains a plausible downstream use of the types of information reported.
What should affected individuals do?
Check whether the email address appears in the relevant Have I Been Pwned record. Treat unsolicited messages about purchases, account problems, payments or delivery as unverified until checked through known official channels.
Use unique account passwords and enable multifactor authentication where available. Where identity details may have been exposed, consider appropriate monitoring measures under the rules of the relevant country. Avoid following contact links or phone numbers supplied within an unexpected message.
What should organizations learn?
Data breaches often create a continuing social engineering risk after the initial technical investigation ends. Security teams should consider whether exposed personal information could support plausible approaches against employees, leadership or trusted counterparties.
The broader lesson is not specific to a clothing retailer. An adversary can combine mundane personal data into a useful intelligence picture. That possibility belongs in a practical Risk & Security assessment.
Source status: As described by Have I Been Pwned and the company's reported January 2026 response. Individual exposure and the full incident scope may differ from the reported dataset size.