Japanese sporting goods maker Mizuno says cyber attack compromised US customers' data

Japanese sports equipment and sportswear company Mizuno said it suffered a data security incident last year that compromised the sensitive personal data of its US-based customers.

 

Headquartered in Peachtree Corners, Georgia, Mizuno USA, a subsidiary of Mizuno Corporation, is one of the world’s largest sporting goods manufacturers specialising in golf, running, baseball, softball, volleyball, swimming, tennis equipment, apparel, and footwear products for North American customers.

 

In a data breach notice filed with the Office of Maine Attorney General, Mizuno USA said that on November 6, it identified suspicious activity in its internal network. The company immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

“The investigation determined that certain systems within the network were accessed by an unknown individual and files were copied without authorisation periodically between August 21, 2024 and October 29, 2024,” reads the notice.

 

The compromised data included names, Social Security numbers, financial account information, driver’s license information, and passport numbers. The company is yet to share the number of individuals affected by the incident.

 

“In response to this event, Mizuno worked quickly to secure the network and begin a comprehensive investigation. We are also evaluating policies, procedures, and technical security measures and implementing additional safeguards as appropriate to further secure the information in our systems,” Mizuno added.

 

The company has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general.

 

It has also offered one year of complimentary identity protection and credit monitoring services through TransUnion to all affected individuals.

 

The infamous BianLian ransomware group claimed responsibility for the ransomware attack on Mizuno in November and listed it as a victim on its data leak site. The group claimed to be in possession of confidential data stolen from the organisation and threatened to leak the same unless the company met its ransom demands. It is unclear if the company negotiated with the ransomware group or paid a ransom.