Adidas is investigating a potential data breach after a threat actor claiming to be part of the Lapsus$ Hacking Group posted on BreachForums alleging they had compromised the company’s extranet.

Key Details of the Alleged Breach

• Scope: Approximately 815,000 rows of data were reportedly exfiltrated.
• Compromised Data: The stolen records allegedly include first and last names, email addresses, passwords, birthdays, company names, and “extensive technical information”.
• Target: The breach appears to have targeted an independent licensing partner—specifically a distributor of martial arts products—rather than Adidas’ own central IT infrastructure.
• Company Response: Adidas stated there is currently no indication that its core IT infrastructure, e-commerce platforms, or consumer data were directly impacted.

Context & Threat Actor

• Lapsus Hunters collective, known for high-profile social engineering attacks against tech giants like Microsoft and Samsung.
• Repeat Incident: This follows a separate third-party security incident in May 2025, where an unauthorized individual accessed data through a customer service provider.
• Credibility: Some researchers suggest the “815,000 rows” claim may be inflated, as the dataset reportedly includes non-user data like system commands (e.g., “DROP TABLE”).