Nike Probing Potential Security Incident as Hackers Threaten to Leak Data

[Brownie2019]

Content source

https://www.securityweek.com/nike-probing-potential-security-incident-as-hackers-threaten-to-leak-data/

Nike has launched an investigation after a cybercrime group claimed to have stolen data from its systems.
The athletic footwear and apparel giant was listed as a victim on the Tor-based leak website operated by the WorldLeaks gang on January 22, and a timer indicates that the stolen data will be made public on January 24, unless a ransom is paid.
The cybercriminals have not specified how much or what type of data they allegedly stole from Nike.
“We always take consumer privacy and data security very seriously,” Nike told SecurityWeek. “We are investigating a potential cyber security incident and are actively assessing the situation.”
WorldLeaks emerged in 2025 following the shutdown of Hunters International, a ransomware group active since late 2023. With the transition to WorldLeaks, the cybercriminals stopped using file-encrypting malware and have concentrated entirely on data theft and extortion.
At the time of writing, the WorldLeaks website names nearly 120 alleged victims. One of them is Dell, which in July 2025 said the hackers had only stolen synthetic or publicly available information.
News of a potential intrusion at Nike comes shortly after clothing retailer Under Armour announced that it’s investigating a data breach involving customers’ email addresses and other personal information.

 

[Bot]

This reads like an extortion-only “data theft” claim (no encryption), and at this stage it should be treated as unconfirmed until Nike (or a regulator) provides details.

What the quote actually tells us

• The actor (“WorldLeaks”) publicly claimed Nike as a victim on January 22, 2026, and threatened publication on January 24, 2026 unless paid.
• No data type, scope, or ransom demand was disclosed in the report you quoted.
• Nike only confirmed they are investigating a “potential cyber security incident” (that is not the same as confirming a breach or confirmed exfiltration).

Because today is January 25, 2026, that “publish on January 24” timer (if accurate) would already have expired — but I can’t safely confirm whether anything was actually posted without independent verification, and I would not recommend visiting criminal leak sites.

Why these claims often stay vague early on

• Extortion groups frequently withhold specifics to maximize pressure.
• Some “victim listings” are exaggerated, recycled, or based on limited access rather than meaningful customer data.
• Even if data exists, it may be a narrow set (e.g., internal documents) rather than consumer PII.

Practical steps for Nike customers (low-risk, sensible defaults)

• Be extra cautious with email/SMS claiming to be from Nike (delivery issues, refunds, “account locked”, “verify your order”). Don’t click embedded links; go to the official site/app directly.
• If you reuse passwords anywhere, change them (start with your email account first), and enable MFA/2FA where available.
• Monitor your email for official breach notifications and watch bank/card statements if you have stored payment methods on any retail accounts.
• Consider checking whether your email appears in known breach datasets via reputable services (and don’t rely on random “breach checker” sites).

For discussion on MalwareTips

The most useful next step is waiting for a concrete indicator: Nike’s follow-up statement, a filing/notification, or reporting that describes the actual data type and impacted populations. Until then, it’s best framed as “Nike investigating after an extortion group claim,” not a confirmed data breach.

 

[ForgottenSeer 123960]

Primary Infiltration & Exploitation Indicators

Vulnerability Targeting
WorldLeaks frequently targets internet-facing infrastructure with weak authentication. Recent campaigns have exploited:

CVE-2025-32819
Authentication bypass in SonicWall SMA 100.

CVE-2024-38475
Improper escaping in Apache HTTP Server.

CVE-2021-20038 & CVE-2021-20035
Legacy SonicWall vulnerabilities for initial access.

Credential Harvesting
Use of Mimikatz and LSASS process dumps remains a core tactic inherited from Hunters International.

Custom Exfiltration Tooling
The group utilizes a proprietary Storage Software utility, an evolved version of the tool used by Hunters International.

Behavioral Marker
The tool manages metadata for exfiltrated files without storing them directly on the group's central servers, using SOCKSv5 proxies over TOR to mask transfer destinations.

Cloud Staging
Frequent exfiltration to MEGA cloud storage via API-based automation.

Infrastructure & Network Markers

C2 Communication
Extensive use of TOR for victim negotiation portals and affiliate management panels.

Leak Site (v4.4)
worldleaksartrjm3c6vasllvgacbi5u3mgzkluehrzhk2jz4taufuid[.]onion.

Lateral Movement
Use of standard administrative tools like net.exe, whoami, and ipconfig /all for automated system enumeration.

Recommendation / Remediation​

For users and organizations monitoring this incident, the following steps are prioritized based on NIST SP 800-61 (Incident Handling) and SANS best practices.

Monitor Official Channels
Avoid interacting with the WorldLeaks Tor site, as these portals often contain malicious scripts or "lure" files. Rely on Nike’s official newsroom or SEC filings for confirmed data impact.

Credential Hygiene
Given the potential for employee or customer data theft, individuals should proactively update passwords for Nike accounts and ensure Multi-Factor Authentication (MFA) is active.

Phishing Awareness
Expect a rise in "social engineering" lures referencing the Nike leak. Be cautious of emails prompting for credential resets that do not originate from verified nike.com domains.

Enterprise Defenses
Organizations should update Threat Intelligence (TI) feeds to include WorldLeaks/Hunters International Indicators of Compromise (IOCs), specifically monitoring for unauthorized data staging or transfer to known exfiltration points.

The "Pure Extortion" model requires a pivot from detecting file-system changes to monitoring data-transfer anomalies (NIST SP 800-94).

Exfiltration Monitoring
Implement egress filtering and rate-limiting on cloud storage domains (e.g., mega.nz). Monitor for high-volume uploads over encrypted channels.

MFA Mandate
Mandatory Multi-Factor Authentication for all VPN, RDP, and SaaS entry points. WorldLeaks' primary entry vector is "Valid Accounts" with weak/no MFA.

SonicWall/Apache Patching
Prioritize the remediation of the CVEs listed above, particularly on edge devices.

Credential Reset
In cases of suspected interaction with WorldLeaks infrastructure, perform a full enterprise-wide credential rotation, as the group specializes in long-term credential persistence.

References​

MITRE ATT&CK
T1078 (Valid Accounts)
T1567 (Exfiltration Over Web Service)
T1048 (Exfiltration Over Alternative Protocol).

NIST SP 800-61 Rev. 2
Incident Handling for Data Breach and Extortion.

SANS Institute
Security Policy and Data Breach Response.

CVE Databases
CVE-2025-32819
CVE-2024-38475.
CVE-2021-20038
CVE-2021-20035