Nike: Nike Hit With Suit Over January Data Breach Affecting Thousands

Nike Faces Lawsuit Over January 2026 Data Breach Impacting Thousands

A proposed class-action lawsuit was filed against Nike in the U.S. District Court for the District of Oregon on Tuesday, alleging the company failed to implement adequate data security measures, leading to a breach of customer information. The complaint accuses Nike of violating common law, contract obligations, industry standards, and the Federal Trade Commission Act by neglecting reasonable safeguards.

The breach, discovered on January 21, 2026, involved unauthorized access to a third-party portal. However, Nike did not notify affected customers until nearly a month later. Lead plaintiff Maria Gomez claims the company’s delayed response and insufficient security protocols exposed sensitive data, leaving thousands at risk.

The lawsuit highlights growing scrutiny over corporate data protection practices and the legal consequences of failing to meet regulatory and industry expectations. The case remains pending in federal court.

Source: https://news.bloomberglaw.com/privacy-and-data-security/nike-hit-with-suit-over-january-data-breach-affecting-thousands

Nike cybersecurity rating report: https://www.rankiteo.com/company/nike

"id": "NIK1774477522",
"linkid": "nike",
"type": "Breach",
"date": "1/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Thousands',
                        'industry': 'Retail/Apparel',
                        'location': 'U.S.',
                        'name': 'Nike',
                        'type': 'Corporation'}],
 'attack_vector': 'Third-party portal compromise',
 'data_breach': {'sensitivity_of_data': 'Sensitive data',
                 'type_of_data_compromised': 'Customer information'},
 'date_detected': '2026-01-21',
 'date_publicly_disclosed': '2026-02-20',
 'description': 'A proposed class-action lawsuit was filed against Nike '
                'alleging the company failed to implement adequate data '
                'security measures, leading to a breach of customer '
                'information via unauthorized access to a third-party portal. '
                'The breach was discovered on January 21, 2026, but affected '
                'customers were not notified until nearly a month later.',
 'impact': {'brand_reputation_impact': 'Growing scrutiny over corporate data '
                                       'protection practices',
            'data_compromised': 'Customer information',
            'identity_theft_risk': 'Thousands at risk',
            'legal_liabilities': 'Proposed class-action lawsuit',
            'systems_affected': 'Third-party portal'},
 'investigation_status': 'Pending',
 'post_incident_analysis': {'root_causes': 'Inadequate data security measures, '
                                           'delayed response'},
 'references': [{'source': 'U.S. District Court for the District of Oregon'}],
 'regulatory_compliance': {'legal_actions': 'Proposed class-action lawsuit',
                           'regulations_violated': ['Federal Trade Commission '
                                                    'Act']},
 'response': {'communication_strategy': 'Delayed notification (nearly a month '
                                        'after discovery)'},
 'title': 'Nike Data Breach Lawsuit',
 'type': 'Data Breach'}