Latest / Tech Talks With Kinsoft / Under Armour Breach – 72 Million Customer Accounts Exposed

Transcript

Under Armour Breach – 72 Million Customer Accounts Exposed · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. Imagine waking
• 0:03
  up one morning and, you know, finding your front
• 0:06
  door just wide open, just swinging in the breeze.
• 0:08
  Oh, that is literally the worst feeling. Right.
• 0:10
  Your heart instantly drops to your stomach. You
• 0:13
  rush inside, you check the obvious spots, and
• 0:16
  the TV is still mounted on the wall. Okay, that's
• 0:19
  a relief. Yeah. You run to the bedroom, and your
• 0:22
  jewelry box is completely untouched. Your wallet
• 0:24
  is sitting exactly where you left it on the dresser.
• 0:27
  So you think you're safe? Exactly. You let out
• 0:29
  this massive full -body sigh of relief. But then...
• 0:34
  Then you walk into your home office and you realize
• 0:36
  someone has taken your personal diary, your address
• 0:38
  book, your calendar and like copies of every
• 0:42
  single receipt you've collected for the last
• 0:43
  five years. Yeah, that is a very specific, incredibly
• 0:47
  unsettling kind of a violation because the obvious
• 0:51
  financial valuables are safe. Right. But the
• 0:53
  context of your life is just gone. It's totally
• 0:55
  gone. The burglar knows exactly where you shop,
• 0:58
  who you talk to, what your daily routines look
• 1:00
  like. And that unsettling feeling. is exactly
• 1:04
  what we're confronting today in the digital world
• 1:07
  because we're looking at the recent massive Under
• 1:10
  Armour data breach. It's a huge one. It really
• 1:13
  is. We're pulling from some extensive reporting
• 1:15
  by TechCrunch and analysis from Malwarebytes
• 1:19
  to piece together exactly what happened between
• 1:22
  late 2025 and January of 2026. Right. And our
• 1:28
  mission for this conversation is to just cut
• 1:30
  straight through the competing narratives. Because
• 1:31
  right now you have aggressive cyber criminals
• 1:34
  making these huge apocalyptic claims on one side.
• 1:37
  And then highly cautious corporate PR teams doing,
• 1:40
  you know, highly choreographed damage control
• 1:42
  on the other. Exactly. So we need to figure out
• 1:44
  the truth. And more importantly, what this actually
• 1:47
  means for your personal data. Yeah. And to understand
• 1:50
  the actual risk you face right now, we have to
• 1:52
  rewind. We have to start with how this whole
• 1:54
  incident began. Let's do it. Because the way
• 1:56
  this story was initially told by the hackers
• 1:58
  versus how it was framed by the brand, I mean,
• 2:00
  it's like they were describing two completely
• 2:02
  different universes. So let's go back to late
• 2:04
  2025, specifically November. There's this ransomware
• 2:08
  group known as Everest, and they publicly claim
• 2:11
  that the sportswear giant Under Armour. is their
• 2:14
  latest victim. Right. And Everest alleges that
• 2:17
  they have accessed around 343 gigabytes of corporate
• 2:21
  data. Which is I mean, just to put that in perspective,
• 2:25
  343 gigabytes of text based data like customer
• 2:28
  records, logs, emails. That is a monstrous amount
• 2:31
  of information. Massive. And they claim they
• 2:34
  are going public with this simply because. Under
• 2:37
  Armour essentially ignored them and failed to
• 2:40
  respond by their extortion deadline. Which is
• 2:42
  a very standard psychological pressure tactic
• 2:44
  in modern ransomware negotiations. How so? While
• 2:46
  these groups don't just lock up your systems
• 2:48
  anymore, they steal the data and hold it hostage.
• 2:50
  So when a company refuses to engage or stalls
• 2:54
  the negotiation, the hackers announce the breach
• 2:57
  on their dark web leak sites to force the company's
• 2:59
  hand. Basically hoping the bad press will terrify
• 3:02
  investors and executives into paying up. But
• 3:04
  Under Armour's official response means a remarkably
• 3:07
  different picture. Their spokesperson, Matt Dornick,
• 3:11
  comes out and states that the company is actively
• 3:14
  investigating the situation alongside external
• 3:17
  cybersecurity experts. Right. The standard PR
• 3:19
  response. Right. But then they draw these very
• 3:22
  firm, very specific lines in the sand. They claim
• 3:25
  there is absolutely no evidence that UA... Their
• 3:29
  payment processing systems or their customer
• 3:32
  password systems were affected in any way. Yeah.
• 3:35
  And they were meticulously careful what they're
• 3:37
  phrasing there. If you read that statement like
• 3:39
  a lawyer, they are building a very specific defensive
• 3:41
  wall. OK, let's unpack this. Yeah. Because Under
• 3:44
  Armour also stated that the number of customers
• 3:46
  who had what they called sensitive information
• 3:49
  compromise was a very small percentage. Right.
• 3:51
  And they flat out called the hackers claims.
• 3:54
  Yeah. You know, that tens of millions of people
• 3:55
  had sensitive personal information exposed. They
• 3:58
  called that completely unfounded. Yes, they did.
• 4:00
  So if Under Armour is definitively saying that
• 4:03
  our passwords are safe, our credit cards are
• 4:05
  safe, our payment systems are untouched, and
• 4:08
  this legally defined sensitive info is barely
• 4:13
  impacted. I mean, is this really just a minor
• 4:15
  hiccup or is the word sensitive doing a massive
• 4:18
  amount of heavy lifting for the corporate legal
• 4:20
  team here? What's fascinating here is the massive
• 4:23
  disconnect between the strict legal definition
• 4:26
  of sensitive data and the real world value of
• 4:30
  the data that hackers actually target. Because
• 4:32
  from a corporate liability standpoint, sensitive
• 4:35
  almost exclusively means highly regulated data.
• 4:38
  We're talking about Social Security numbers,
• 4:40
  full credit card numbers, bank account routing
• 4:43
  details. The big stuff. Exactly. If those specific
• 4:46
  fields aren't breached, a company will technically
• 4:49
  and legally tell you that sensitive data wasn't
• 4:51
  exposed. Because according to the letter of the
• 4:53
  law, they are arguably correct. Precisely. It's
• 4:56
  a compliance definition, not a practical one.
• 4:59
  But hackers don't operate on legal definitions.
• 5:02
  To a cybercriminal, your purchase history, your
• 5:05
  geographical location and your birth date are
• 5:07
  incredibly valuable commodities on the underground
• 5:10
  market. So the real world fallout from losing
• 5:13
  that supposedly nonsensitive data is actually
• 5:16
  pretty severe. Oh, absolutely. In fact, a class
• 5:18
  action lawsuit has already been filed in the
• 5:20
  U .S. alleging negligence against Under Armour
• 5:22
  regarding this very breach. So regardless of
• 5:25
  the careful corporate framing, you know, and
• 5:27
  the reassurance that the wider breach claims
• 5:29
  are unfounded, the legal and practical consequences
• 5:32
  are actively unfolding. Which brings us to the
• 5:34
  moment where we actually get to see who is telling
• 5:36
  the truth, because corporate statements heavily
• 5:39
  downplayed the severity of this throughout the
• 5:41
  end of 2025. Right. PR is telling everyone to
• 5:44
  stay calm. Everything is legally fine. Exactly.
• 5:47
  But let's look at what the hackers actually dumped
• 5:49
  on the dark web when their extortion deadline
• 5:51
  finally expired. Does the evidence actually back
• 5:55
  up that corporate confidence? Well, unfortunately
• 5:57
  for the millions of people in that database,
• 6:00
  the hackers weren't bluffing. No, they certainly
• 6:03
  were not. In January of 2026, Everest's threats
• 6:07
  materialized. A massive data set was published
• 6:10
  on a popular hacking forum, and Everest claimed
• 6:12
  this data was quickly duplicated across various
• 6:15
  leak sites and underground databases. And the
• 6:17
  scale of what was published is just staggering.
• 6:20
  It really is. The data set contains roughly 72
• 6:23
  million customer email addresses. That equates
• 6:26
  to about 72 .7 million unique user accounts,
• 6:30
  all pulled from a larger database of over 191
• 6:33
  million total records. Yeah, and at this point,
• 6:35
  we aren't just taking the cybercriminals at their
• 6:37
  word. The verification process for this kind
• 6:39
  of leak is actually very robust. Right, both
• 6:42
  TechCrunch and the widely respected breach notification
• 6:44
  site. Have I Been Proud obtained the data? Have
• 6:47
  I Been Proud officially listed the breach and
• 6:49
  actually went ahead and notified 72 million individuals
• 6:52
  that their information was circulating in the
• 6:53
  wild? That's a massive notification. It is. But
• 6:57
  here is the critical detail. It's not just a
• 6:59
  list of random email addresses. Many of these
• 7:02
  records contain full names, dates of birth, genders,
• 7:06
  approximate physical locations based on ZIP or
• 7:09
  postcodes, and highly detailed purchase histories.
• 7:13
  And the location data and purchase histories
• 7:15
  are really what elevate this from a minor nuisance
• 7:17
  to a major threat. And it's worth noting, too,
• 7:20
  that the leak even includes the email addresses
• 7:23
  belonging to Under Armour's own employees. Wow,
• 7:26
  really? Yeah, which raises massive questions
• 7:28
  about how compartmentalized their internal data
• 7:31
  actually was. I mean, that completely shatters
• 7:33
  the illusion that this is a minor incident affecting
• 7:35
  a very small percentage of people. Bringing you
• 7:38
  back to our earlier analogy. The hackers don't
• 7:40
  have the keys to your bank account, but they
• 7:42
  have that highly detailed dossier of your life.
• 7:44
  Exactly. They broke in, ignored the safe and
• 7:47
  took your diary and your shopping receipts. And
• 7:49
  from an analytical perspective, when we look
• 7:52
  at the balance of probabilities during a breach,
• 7:54
  we have to recognize the reality of cybercrime
• 7:57
  economics. Do ransomware groups sometimes lie
• 8:00
  or exaggerate their access to cause panic? Absolutely.
• 8:03
  Sure. But spinning up a massive leak entry. formatting
• 8:06
  and publishing 72 million verifiable records
• 8:10
  across multiple underground forums, and then
• 8:12
  distributing sample data to journalists. That
• 8:16
  requires a significant investment of time and
• 8:18
  resources. And I would assume it would also be
• 8:20
  instantly disproven the second anyone searched
• 8:23
  for their own data in the dump. Like if a journalist
• 8:25
  checks their own email and sees fake purchase
• 8:27
  history, the hackers lose all their credibility.
• 8:30
  That's exactly how the verification works. The
• 8:32
  data set is simply too robust, too internally
• 8:35
  consistent to be faked. Wow. Which means we need
• 8:39
  to emphasize that this specific combination of
• 8:42
  data, your date of birth, your location, what
• 8:44
  you bought and when, is an absolute goldmine
• 8:47
  to bad actors, even without your password attached
• 8:49
  to it. Okay, let's explore that. Because if I'm
• 8:51
  a hacker and I have this mask spreadsheet, but
• 8:53
  I don't have your password, what do I actually
• 8:55
  do with it? I'm not going to try and manually
• 8:56
  guess your password. I'm going to weaponize the
• 8:59
  information I do have to trick you, right? Yeah,
• 9:01
  that leads us directly to the real world risks.
• 9:04
  Now that we've established exactly what kind
• 9:06
  of data is circulating in the wild, we really
• 9:08
  need to bridge the gap between this abstract
• 9:11
  cyber event happening on dark web forums and
• 9:13
  your daily digital life. Right. The primary weapon
• 9:16
  here is targeted phishing. Here's where it gets
• 9:19
  really interesting. Let's build that scenario.
• 9:21
  Because instead of a generic spammy email saying,
• 9:25
  dear customer, your account is locked. Click
• 9:27
  here. The hackers. now have the context to be
• 9:30
  terrifyingly specific. Exactly. Hackers use the
• 9:34
  specific, supposedly non -sensitive data to craft
• 9:37
  highly convincing personalized attacks. You might
• 9:40
  get an email that says, Dear John, there is an
• 9:43
  issue with the warranty on the exact size 10
• 9:45
  running shoes you bought last October and had
• 9:47
  shipped to your Chicago ZIP code. Please click
• 9:49
  here to verify your account. If I get that email,
• 9:52
  I'm almost certainly going to assume it's legitimately
• 9:54
  from Under Armour. How else would anyone know
• 9:57
  the shoe size, the purchase month, and my specific
• 10:00
  ZIP code? It bypasses my mental spam filter instantly.
• 10:04
  They impersonate the brand or they might even
• 10:06
  impersonate delivery services like FedEx or UPS,
• 10:09
  referencing real past purchases to create a false
• 10:12
  sense of urgency. And this is why the actionable
• 10:15
  advice from sources like Malwarebytes is so critical
• 10:18
  right now. Because the playbook for defending
• 10:20
  yourself have to evolve based on how these attacks
• 10:23
  are structured. Exactly. So let's figure out
• 10:26
  our actual move here. If Under Armour is adamant
• 10:29
  that passwords weren't leaked in this specific
• 10:32
  breach. Why does a security firm like Malwarebytes
• 10:36
  recommend changing passwords as one of the very
• 10:39
  first steps? Isn't that fixing a lock that isn't
• 10:41
  broken? If we connect this to the bigger picture.
• 10:44
  You have to understand the full lifecycle of
• 10:46
  a hack. The initial data breach, the dumping
• 10:49
  of those 72 million records, is rarely the end
• 10:52
  of the story. It's really just the gathering
• 10:54
  phase. The gathering phase. The leaked data we
• 10:56
  just talked about, your name, your email, your
• 10:58
  purchase history, that is the ammunition. Hackers
• 11:00
  are stockpiling that ammunition to trick you
• 11:03
  into handing over your password tomorrow during
• 11:05
  one of those highly targeted phishing attacks
• 11:07
  we just described. Ah, I see. So they use the
• 11:10
  trusted context of my purchase history to lower
• 11:12
  my defenses. I click the link in that fake warranty
• 11:15
  email. It takes me to a fake Under Armour login
• 11:17
  page that looks completely authentic. I type
• 11:20
  in my password and boom, now they actually have
• 11:23
  it. Precisely. Furthermore, people reuse passwords
• 11:25
  constantly. If they can trick you into revealing
• 11:28
  your Under Armour password, they will immediately
• 11:30
  test that same email and password combination
• 11:33
  on your banking app, your email provider, your
• 11:36
  social media accounts. That's called credential
• 11:38
  stuffing. So changing your passwords now, using
• 11:41
  a password manager to ensure every single account
• 11:44
  has a strong, completely unique password disrupts
• 11:47
  their ability to pivot if they do manage to trick
• 11:50
  you. That makes perfect sense. Now, Malwarebytes
• 11:52
  also strongly recommends enabling two -factor
• 11:54
  authentication, or 2FA, but they make a very
• 11:57
  crucial distinction here. They specifically highlight
• 11:59
  using FIDO2 -compliant hardware keys or FIDO2
• 12:03
  -compliant laptops and phones. Wait, pause for
• 12:06
  a second. When you say FIDO2 hardware key, are
• 12:08
  we talking about a literal... physical key I
• 12:11
  put on my keychain, how does that actually plug
• 12:14
  into my digital life? It often is a literal physical
• 12:18
  device, yes. It looks like a small USB thumb
• 12:21
  drive that you keep on your keychain or plugged
• 12:23
  into your laptop. FIDO2 is really just the technical
• 12:26
  standard it uses. Sometimes this technology is
• 12:29
  also built directly into your modern smartphone
• 12:31
  or laptop, utilizing your fingerprint or FaceSight.
• 12:34
  But the reason cybersecurity experts are practically
• 12:37
  begging people to use FIDO2 instead of the traditional
• 12:40
  six -digit code you get via text message is because
• 12:43
  of how it handles the authentication map. How
• 12:45
  so? Because a text message code seems pretty
• 12:48
  secure to the average person. A text message
• 12:50
  code can be intercepted, or more commonly, a
• 12:52
  hacker can just build a fake website that asks
• 12:55
  you to type in the code they just triggered.
• 12:57
  But a FIDO2 hardware key uses something called
• 12:59
  cryptographic origin binding. Okay, let's keep
• 13:02
  that jargon free for everyone listening. How
• 13:04
  does origin binding actually protect me? Think
• 13:07
  of it like a highly trained, deeply paranoid
• 13:10
  bouncer. When you try to log in, your FIDO2 key
• 13:13
  doesn't just verify your identity. It looks at
• 13:16
  the actual underlying URL of the website you
• 13:19
  are on. How interesting. If you click a phishing
• 13:22
  link and end up on fake -underarmor .com, you
• 13:25
  might be fooled because the website looks identical.
• 13:27
  But when you press the button on your hardware
• 13:29
  key, the key checks the URL mathematically. It
• 13:32
  realizes, wait. This isn't the real Under Armour
• 13:35
  server, and it simply refuses to provide the
• 13:37
  cryptographic token. So even if I completely
• 13:39
  fall for the phishing email and I type in my
• 13:42
  password on the fake site, the hacker still can't
• 13:44
  get in because my physical key refuses to sign
• 13:47
  off on the fake location. That is the beauty
• 13:49
  of it. The math won't let the hacker succeed
• 13:51
  regardless of human error. It stops the phishing
• 13:54
  attack dead in its tracks. Unlike an SMS text
• 13:57
  message code, IDO2 physically cannot be phished.
• 14:00
  That is why it is the inevitable next step in
• 14:02
  securing... That is incredibly empowering to
• 14:06
  know. And alongside setting up hardware to F
• 14:09
  .A., Malwarebytes suggests a few other defensive
• 14:12
  maneuvers. They say you need to be hypervigilant
• 14:15
  against impersonators. Always independently verify
• 14:17
  the source of urgent emails or text messages.
• 14:20
  Absolutely. If you get a weird warranty claim,
• 14:22
  don't click the link. Open a new browser tab,
• 14:25
  go to the actual website yourself, and check
• 14:27
  your account there. It's about breaking the chain
• 14:29
  of urgency. Hackers rely on you panicking and
• 14:32
  clicking quickly. Taking a 10 -second pause to
• 14:35
  navigate to the site independently ruins their
• 14:37
  entire strategy. They also suggest you consider
• 14:40
  not storing your credit card details on retail
• 14:42
  sites in the future. Just enter it fresh every
• 14:45
  time or use virtual card numbers to universally
• 14:48
  minimize your risk. And finally, set up identity
• 14:51
  monitoring to track if your personal data is
• 14:53
  actively being traded illegally. Identity monitoring
• 14:56
  gives you visibility. You can't undo a data breach,
• 14:58
  but knowing exactly what information of yours
• 15:01
  is out there allows you to anticipate the specific
• 15:03
  types of scams that will be thrown at you. Which
• 15:05
  really brings this whole journey to a sobering
• 15:08
  but clarifying close. We started with a vague,
• 15:11
  carefully worded corporate claim in late 2025.
• 15:15
  a PR statement that dismissed a massive breach
• 15:18
  as unfounded and insisted it only affected a
• 15:21
  very small percentage of people because no legally
• 15:24
  regulated data was stolen. And we followed the
• 15:27
  evidence to a verified reality where 72 million
• 15:30
  incredibly detailed customer records were dumped
• 15:33
  on the dark web in January of 2026. To summarize
• 15:37
  everything we've unpacked, while Under Armour
• 15:39
  maintains to this day that their payment processing
• 15:41
  and password systems are entirely safe, The Everest
• 15:44
  ransomware group successfully leaked a massive
• 15:47
  dataset of personal histories. What this proves,
• 15:50
  beyond a shadow of a doubt, is that data corporations
• 15:53
  eagerly classify as non -sensitive, like your
• 15:56
  purchase history, your gender, your location,
• 15:58
  and your birthday, can still pose a massive phishing
• 16:00
  and privacy threat to your everyday life. It
• 16:02
  radically shifts the burden of security. If the
• 16:04
  data that makes you vulnerable isn't protected
• 16:06
  by law, the responsibility to defend against
• 16:09
  the fallout lands squarely on the consumer. It
• 16:11
  really does. And it leaves us with a pretty massive
• 16:14
  question to chew on. Think about this. We essentially
• 16:17
  built a massive legal fortress around the credit
• 16:19
  card number, complete with strict regulations
• 16:21
  and compliance laws. Yeah. But if a major corporation
• 16:25
  can lose 72 million detailed customer profiles
• 16:29
  dossiers that map out where people live, what
• 16:32
  they buy, and when they were born, and that corporation
• 16:34
  can still successfully argue to the public that
• 16:37
  no legally sensitive information was compromised.
• 16:40
  Have we built the moat around the wrong castle?
• 16:41
  Exactly. Do our legal definitions of data privacy
• 16:44
  need a massive modern overhaul that protects
• 16:48
  the human being, not just the financial asset?
• 16:50
  It's a crucial debate. Because right now, the
• 16:53
  framework is incredibly outdated compared to
• 16:55
  how cyber criminals actually monetize our identities.
• 16:58
  Taking control of your own digital security is
• 17:01
  truly no longer optional. You absolutely have
• 17:03
  to be proactive. And on that note, we'll warmly
• 17:06
  encourage you to visit www .kinsoft .com .au
• 17:09
  to discuss your own security and IT needs. Staying
• 17:12
  proactive, setting up those Fighter 2 hardware
• 17:14
  keys we talked about, and understanding the real
• 17:16
  value of your personal data is the absolute best
• 17:19
  defense you have in this rapidly changing landscape.
• 17:21
  Thank you so much for joining us and stay safe
• 17:23
  out there.