Massive Adidas Breach Exposes 815K Accounts

What Happened in the Breach

A threat actor using the Lapsus$ name claimed on February 16, 2026 that it had breached the Adidas Extranet and stolen 815,000 rows of data, listing first and last names, email addresses, passwords, birthdays, company names and technical data. Adidas traced the incident to an independent licensing partner that distributes its martial arts products and runs its own IT systems.

Cybernews researchers named the partner as Double D, a French combat sports licensee founded in 1994, and found only about 130 accounts holding real user records inside the dump. SQL commands and database filler made up the rest of the 815,000 rows. A formal vendor risk management program scores partner controls, caps external access and writes incident-reporting duties into contracts before a licensee ever touches a shared portal.

The group followed up with a warning that “something bigger is coming” and claimed a further 420GB of Adidas data tied to the French market. No 420GB release has surfaced publicly as of September 2026, a gap that fits the group’s habit of inflating big-brand names for notoriety.

Timeline: From First Access To Latest Update

1. May 2025: Adidas notifies customers that an unauthorized individual accessed a third-party customer service provider and took consumer contact information.
2. October 2025: Scattered Lapsus$ Hunters lists Adidas on its extortion leak site.
3. February 16, 2026: A Lapsus$-branded account on BreachForums advertises an “Adidas Extranet” database with 815,000 rows of names, emails, passwords, birthdays and company data.
4. February 17, 2026: Cybernews publishes the claim alongside the group’s teaser of 420GB in French market data.
5. February 18, 2026: Adidas confirms a potential data protection incident at an independent licensing partner and martial arts distributor, with no sign that its own IT infrastructure, e-commerce platforms or consumer data were affected.
6. February 19, 2026: Cybernews ties the data to Double D, a French combat sports licensee, and counts roughly 130 genuinely affected accounts.
7. September 2026: No regulator action, lawsuit, arrest or 420GB leak has surfaced, and Adidas has not publicly named the partner.

What Data Or Systems Were Affected

The compromised system belonged to Double D, the licensee behind Adidas combat sports gear, and served its employees and resellers. Adidas runs its own network, online stores and consumer records on separate infrastructure that the attacker never reached.

The dump listed names, email addresses, passwords, birthdays, company affiliations and technical data. No payment card numbers or consumer order records appear in it. Raw database commands pad most of the 815,000 rows, which puts the real exposure near 130 accounts: a pool of reseller and staff logins large enough for targeted phishing and small enough to reset in a single afternoon.

The 420GB cache the group advertised remains unverified. No samples of design files, source code or French market documents have been published.

Who Was Responsible (Confirmed Vs Alleged)

No law enforcement agency has named a suspect. The BreachForums listing carried the Lapsus$ name, a brand now used by Scattered Lapsus$ Hunters, the collective formed in August 2025 from Lapsus$, Scattered Spider and ShinyHunters.

The original Lapsus$ crew hit Nvidia, Microsoft, Samsung and Okta in 2021 and 2022 before seven arrests in March 2022 broke it up. Whoever posted the Adidas data borrowed that brand, offered no proof of access to Adidas systems and inflated a small licensee dump into an 815,000-row headline. Attribution stays unconfirmed.

How The Attack Worked

Neither Adidas nor Double D has disclosed the entry point. Scattered Lapsus$ Hunters members typically break in through social engineering: help desk impersonation, phishing for SSO credentials and SIM swaps that defeat SMS codes. A licensee portal guarded by a single password falls to any one of those.

The dump itself hints at the technique. SQL statements mixed into the rows point to a database export pulled through a web application, exactly the activity a data exfiltration prevention strategy flags with bulk query alerts and outbound volume thresholds.

Neither company has confirmed a root cause. Weak multi-factor authentication on partner accounts and thin logging at a small licensee remain the likeliest reasons an export of that size left undetected.

No ransomware or destructive malware appeared in the incident. The goal was data theft and publicity.

Impact and Risks for Customers

Adidas shoppers carry little direct risk, since consumer accounts and order data sat outside the breached system. The exposure falls on Double D staff and resellers, whose names, emails and passwords now circulate on a criminal forum. Reused passwords give attackers a path into other reseller tools, and Adidas-branded emails give phishers a believable pretext.

Anyone holding a Double D or Adidas combat sports reseller account needs to change that password now, rotate it anywhere it was reused and switch on app-based MFA. Emails about Adidas orders, invoices or account resets from unfamiliar senders deserve a call to a known contact before anyone clicks a link.

Company Response And Customer Remediation

Adidas confirmed on February 18, 2026 that it was investigating the incident with the affected partner. The company declined to name the licensee, specify the data categories, give a breach date or describe remediation steps. A documented cyber threat intelligence and incident response process lets teams validate threat-actor claims fast, and the drop from 815,000 claimed rows to 130 real accounts shows how sharply a quick dump analysis shrinks an incident’s scope.

No public breach notice, credit monitoring offer or compensation has followed. That silence matches an incident confined to business contacts at a single licensee.

Government, Law Enforcement, And Regulator Actions

No European data protection authority has announced an investigation, and no enforcement action has surfaced as of September 2026. Double D is a French company, which makes France’s CNIL its lead supervisor under the EU General Data Protection Regulation (GDPR), and Article 33 gave the licensee 72 hours after becoming aware of a personal data breach to notify the regulator.

No arrests tied to the Adidas listing have been announced. Adidas is a repeat target for the same collective, which placed the company on its extortion leak site in October 2025.

Financial, Legal, And Business Impact

GDPR fines top out at €20 million or 4% of global annual turnover. Those penalties land on the controller that failed, which here is the licensee holding roughly 130 real records, so the direct financial exposure for Adidas is small.

The larger cost is reputational. A Lapsus$-branded post turned a small licensee leak into global headlines carrying the Adidas name, the second partner incident in nine months after the May 2025 customer service breach. Brand owners in that position tend to tighten license agreements with security clauses, audit rights and breach notice deadlines, and that contract work is where the lasting business impact of this incident lands.

What Remains Unclear About the Adidas Extranet Scare

• How the attacker got into Double D’s systems and how long access lasted.
• Whether passwords in the dump were hashed or stored in plaintext.
• Whether the 420GB French market cache exists at all.
• Whether the poster belongs to Scattered Lapsus$ Hunters or only borrows the Lapsus$ name.
• Whether Double D filed a breach notification with the CNIL.

Why This Incident Matters

Brand licensing creates a vendor tier that third-party risk programs routinely skip. Licensees sell under the parent brand, run their own IT and hold reseller and staff data, so a breach at a small partner reaches the press with the parent’s name attached. Two partner incidents in nine months put Adidas in exactly that position.

The gap between 815,000 claimed rows and 130 real accounts matters for response teams. Extortion crews inflate numbers because the press repeats the first figure, and a team that samples and deduplicates a dump before issuing statements controls the second headline.

Vendor security needs continuous assessment, with preparation for lateral attacks through third-party connections. A continuous compliance program tracks vendor access, MFA coverage, logging controls, security findings and remediation work throughout the relationship, with licensees included in the same review cycle as core suppliers.

Bright Defense: Pen Testing and Continuous Compliance

Bright Defense reduces identity driven intrusion risk through penetration testing and continuous compliance focused on SSO paths, SaaS misconfigurations, and help desk and MFA reset social engineering. Testing checks whether a single phished identity can reach customer data stores and provides remediation mapped to SOC 2 Trust Services Criteria. 

Continuous compliance keeps identity, access, logging, and incident response controls current through recurring checks and evidence workflows, prioritizing phishing resistant MFA, tighter conditional access for privileged accounts, stronger help desk verification, centralized logging and alerting, and regular incident response exercises.

Add Bright Defense as a Preferred Source on Google

Sources

1. HelpNetSecurity: Adidas investigates alleged data breach affecting 815,000 records (19 Feb 2026).
   
2. SCWorld: Third‑party hack probed by Adidas amid data theft assertions (Feb 2026).
   
3. Cyberpress: Adidas Data Breach: 815,000 records of data allegedly stolen (Feb 2026).
   
4. DarknetSearch: Adidas Data Breach Exposed: 815,000 Extranet Records Leaked (16 Feb 2026).
   
5. CyberNews: Lapsus$ gang claims Adidas breach and warns “something bigger” (Feb 2026).
   
6. CyberSecurityNews: Adidas Investigates Alleged Data Breach (19 Feb 2026).
   
7. Shieldworkz: A deep‑dive into the Adidas extranet breach (Feb 2026).
   
8. The Register: Adidas investigates third‑party data breach (18 Feb 2026).
   
9. TechRadar: Hackers claim breach of Adidas systems: but it says a third‑party is at fault (Feb 2026).
   
10. Troypoint: Adidas Data Breach: Hacker Group Warns of Another Attack Soon (Feb 2026).
11. heise online: Adidas comments on possible data leak at external service provider (Feb 2026).
12. SGI Europe: Adidas probes partner data breach (Feb 2026).