Nike probes potential cyber incident after hackers claim data leak

Sportswear giant Nike said it is investigating a potential cybersecurity incident after a hacking group claimed it had leaked a large volume of the company’s internal data.

The company said in a brief statement that it takes consumer privacy and data security seriously and is “actively assessing the situation,” but offered few details about the scope of the alleged breach or whether customer information may have been exposed.

Earlier this week a ransomware group known as WorldLeaks claimed on the dark web that it had leaked more than 1.4 terabytes of data allegedly belonging to Nike. The group said the material includes internal documents, archives from the past five years and information related to the company’s supply chain and manufacturing operations.

The authenticity of the data has not been independently verified, and it remains unclear whether customer data is part of the purported leak. Nike did not say whether it had received ransom demands or whether it was in contact with the attackers. The company did not immediately respond to a request for comment.

WorldLeaks is believed to be a rebranding of the now-defunct Hunters International operation, which shut down last year. Cybersecurity researchers have previously suggested that some administrators behind both groups may have ties to the Hive ransomware operation, a prolific ransomware syndicate dismantled by law enforcement in 2023.

The group has claimed hundreds of victims so far. Earlier in July, it allegedly breached tech manufacturer Dell, though the company said at the time that no sensitive information had been involved.

Nike is the latest sportswear brand to face cyberattack claims. Last week, Under Armour said it was investigating allegations that hackers had posted millions of customer records on an online forum, including names, email addresses and purchase-related data. It was not immediately clear whether the incidents involving Nike and Under Armour were connected.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Daryna Antoniuk

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

 

Total
0
Shares
Previous Post

ClickFix Attacks Expand Using Fake CAPTCHAs, Microsoft Scripts, and Trusted Web Services

Next Post

Experts Detect Pakistan-Linked Cyber Campaigns Aimed at Indian Government Entities

Related Posts

Critical n8n Flaw (CVSS 9.9) Enables Arbitrary Code Execution Across Thousands of Instances

A critical security vulnerability has been disclosed in the n8n workflow automation platform that, if successfully exploited, could result in arbitrary code execution under certain circumstances. The vulnerability, tracked as CVE-2025-68613, carries a CVSS score of 9.9 out of a maximum of 10.0. The package has about 57,000 weekly downloads, according to statistics on npm. "Under certain
Read More

Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088

Google on Tuesday revealed that multiple threat actors, including nation-state adversaries and financially motivated groups, are exploiting a now-patched critical security flaw in RARLAB WinRAR to establish initial access and deploy a diverse array of payloads. "Discovered and patched in July 2025, government-backed threat actors linked to Russia and China as well as financially motivated
Read More

Python-Based WhatsApp Worm Spreads Eternidade Stealer Across Brazilian Devices

Cybersecurity researchers have disclosed details of a new campaign that leverages a combination of social engineering and WhatsApp hijacking to distribute a Delphi-based banking trojan named Eternidade Stealer as part of attacks targeting users in Brazil. "It uses Internet Message Access Protocol (IMAP) to dynamically retrieve command-and-control (C2) addresses, allowing the threat actor to
Read More