Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Nike confirmed in late January 2026 that it was investigating a potential cybersecurity incident after the extortion group WorldLeaks claimed to have stolen about 1.4 TB of Nike data—nearly 190,000 files, according to BleepingComputer.
The public record does not establish that the entire archive was genuine, that it primarily contained customer data, or that Nike’s later consumer notification involved the same dataset. A subsequent lawsuit described unauthorized access to a third-party-hosted portal and potentially exposed consumer information, while a later legal summary said Nike’s notice characterized the information as limited and excluded full payment-card details and account credentials.
What Nike confirmed
Nike’s initial public response was cautious: the company said it was investigating a potential cybersecurity incident and assessing the situation. That statement confirmed an investigation, not WorldLeaks’ broader claim that it had stolen and leaked 1.4 TB of Nike files.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsInitial reporting also did not establish whether the purported files were authentic or whether customer, employee, supplier, or partner information was included. INCIBE-CERT reported on February 19 that Nike had not publicly confirmed the legitimacy of the files or the exposure of sensitive third-party data.
#1 Best Overall
What WorldLeaks claimed
WorldLeaks listed Nike on its dark-web leak site and claimed to have stolen approximately 1.4 TB of data, representing nearly 190,000 files. The claim was reported by cybersecurity media and financial news outlets, but the figures came from the extortion group and were not independently verified in the initial coverage.
The Nike listing was later removed. Its disappearance does not prove that Nike negotiated with WorldLeaks, paid a ransom, or reached a settlement. Possible explanations include a change in the group’s leak site, negotiations, removal by the group, or another unexplained development. No reliable public source in the available record confirms a ransom payment.
Who is WorldLeaks?
Cybersecurity reporting describes WorldLeaks as an extortion operation focused on stealing data and threatening publication. BleepingComputer reported that the group was believed to be a rebrand of Hunters International after that operation shifted toward extortion-only activity in January 2025. That is a media and intelligence assessment, not a court finding.
This type of attack differs from conventional ransomware:
- Traditional ransomware: attackers encrypt systems and demand payment for a decryption key.
- Exfiltration-based extortion: attackers steal data and threaten to publish it.
- Double extortion: attackers encrypt systems while also threatening to release stolen data.
Public reporting about Nike focused on alleged data theft and leak-site pressure, not confirmed system encryption.
What data was allegedly involved?
Corporate files claimed by WorldLeaks
Secondary coverage of purported samples described material involving product development, design, manufacturing, suppliers, training, and corporate strategy. These descriptions should be treated as reports about alleged samples—not a verified inventory of Nike’s stolen data. The authenticity and completeness of the 1.4 TB archive were not conclusively established in the initial reporting.
Rank #3
Consumer information described in later records
A class-action complaint filed in March says Nike discovered unauthorized access to a portal hosted by a third-party provider around January 21, 2026. The complaint says Nike’s breach notification identified the following information as potentially accessed:
- Names
- Email addresses
- Billing addresses
- Phone numbers
- Transaction information
- Payment-card information
However, a June legal summary reported that Nike’s notice characterized the incident as involving “limited consumer information” and stated that full payment-card details and account credentials were not accessed. The original notice would be the best source for confirming its exact language.
Was Nike customer payment data exposed?
The answer remains qualified. Early reporting did not establish that customer information was included in the WorldLeaks archive. The later lawsuit says Nike’s notice involved certain customer and transaction information, including payment-card information, while the later summary says the notice excluded full card details and account credentials.
That means it would be inaccurate to state that WorldLeaks stole Nike customers’ complete credit-card numbers. It is also too broad to say that no customer data was exposed. The most defensible description is that Nike’s later breach notification reportedly involved limited consumer information, while the relationship between that incident and WorldLeaks’ alleged 1.4 TB corporate archive remains unproven.
Confirmed, alleged, and unknown
| Question | What the public record supports |
|---|---|
| Did Nike investigate a potential incident? | Yes. Nike said it was investigating a potential cybersecurity incident. |
| Did WorldLeaks claim a 1.4 TB theft? | Yes. The claim included nearly 190,000 files. |
| Did Nike initially authenticate the files? | No public authentication was reported in the initial coverage. |
| Was consumer information later identified in a notice? | The class-action complaint says yes. |
| Were full card details exposed? | A later summary of Nike’s notice said no; broader allegations remain disputed. |
| Were account passwords exposed? | A later summary of Nike’s notice said no. |
| Was a ransom paid? | No reliable public confirmation was identified. |
| Was the 1.4 TB archive the same dataset as the consumer incident? | That has not been publicly established. |
Timeline of the Nike incident
- January 21, 2026: The later class-action complaint says Nike discovered unauthorized access.
- January 22–26: WorldLeaks reportedly listed Nike and claimed to have stolen data.
- January 24: Contemporary reporting described a ransom deadline associated with the listing. Whether Nike received or paid a demand was not confirmed.
- January 26–27: Nike publicly said it was investigating a potential cybersecurity incident.
- Before January 27: The WorldLeaks listing was reportedly removed, for reasons that remain unknown.
- February 19: INCIBE-CERT reported that Nike had not publicly confirmed the alleged files’ authenticity or the exposure of sensitive third-party data.
- February 25: The complaint says Nike began notifying affected individuals.
- March 24: Maria Gomez filed Gomez v. Nike, Inc., Case No. 6:26-cv-00564, in the U.S. District Court for the District of Oregon.
What the lawsuit alleges
The complaint alleges that Nike failed to use adequate security controls, failed to protect or encrypt sensitive information adequately, delayed notifying affected individuals, and breached legal duties involving negligence, implied contract, unjust enrichment, and California privacy theories.
Those are allegations, not findings by a court. The proposed class action seeks at least $5 million, damages, injunctive relief, and identity-monitoring protections. None of those requested remedies had been awarded in the available record.
Best Value
The complaint describes roughly five weeks between Nike’s alleged January 21 discovery and February 25 notifications. Whether that timing violated any notification requirement depends on the applicable law, what Nike knew at each stage, and whether the notice satisfied the relevant legal standards. The available research does not independently verify the lawsuit’s later procedural schedule or establish a court ruling by August 18, 2026.
What Nike customers should do
- Check for an authentic notice. Review communications through Nike’s official channels, and do not rely on unsolicited links or phone numbers in breach-related messages.
- Change reused passwords. If you used a Nike password elsewhere, replace it on every affected service and enable multifactor authentication where available.
- Review account and payment activity. Watch Nike accounts, bank statements, and card statements for unfamiliar activity.
- Expect targeted phishing. Messages mentioning Nike orders, refunds, shipping, or account verification may be designed to exploit the incident.
- Consider a credit freeze when appropriate. A freeze may be sensible if your notice indicates that identity or financial information was exposed. Contact the relevant card issuer promptly if unauthorized transactions appear.
Do not download alleged leaked files, visit dark-web leak sites, or pay anyone claiming to sell or unlock Nike data.
Quick Recap
What remains unknown as of August 18, 2026
- The initial-access method.
- The identity of the third-party provider associated with the portal.
- Whether all or part of the 1.4 TB archive was authentic Nike data.
- Whether the archive contained customer information.
- Whether the WorldLeaks claim and the later consumer notification concerned the same incident or dataset.
- How many consumers were affected.
- Whether Nike negotiated with or paid WorldLeaks.
- Whether additional data was published, removed, or recovered.
- The final status of the class action.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
