Adidas Investigates Alleged Data Breach – 815,000 Records of Customer Data Stolen
Adidas is currently investigating a potential data breach involving one of its independent third-party partners. The issue came to light when a threat actor, identified as "LAPSUS-GROUP," claimed on BreachForums on February 16, 2026, to have accessed…
Adidas is currently investigating a potential data breach involving one of its independent third-party partners. The issue came to light when a threat actor, identified as "LAPSUS-GROUP," claimed on BreachForums on February 16, 2026, to have accessed Adidas' extranet portal without authorization.
The threat actor, linked to the Scattered Lapsus$ Hunters collective, alleges the extraction of approximately 815,000 data entries from the Adidas Extranet. This portal is used by authorized business partners, suppliers, and retailers to interact with the company.
The compromised dataset reportedly includes:
First and last names Email addresses Passwords Birthdays Company information Other technical data
Adidas is currently investigating a potential data breach involving one of its independent third-party partners.
Additionally, the group indicated that further disclosures could follow and claimed possession of around 420GB of Adidas-related data, particularly linked to the French market.
An Adidas spokesperson confirmed awareness of a potential data protection incident with an independent licensing partner and distributor for martial arts products. The company clarified that the partner operates its own IT systems and there is currently no indication that Adidas' IT infrastructure, e-commerce platforms, or consumer data are compromised.
This incident follows a separate third-party breach disclosed in May 2025, where unauthorized access to a third-party customer service provider exposed contact details of Adidas customers. No passwords or financial data were compromised in that event.
Enforce strict least-privilege access Mandate multi-factor authentication for third-party interactions Conduct regular audits of partner-facing portals
These measures aim to reduce exposure from extranet-style attack surfaces. Adidas has not confirmed the timeline of the compromise or detailed the specific data accessed, as the investigation is ongoing.
Based on reporting by Cyber Security News.
