Nike faces class-action lawsuit over alleged January 2026 data breach

Nike is facing a nationwide class-action lawsuit in federal court in Oregon over allegations that the company failed to adequately protect customer data during a cyberattack discovered in January 2026.

The complaint, filed by plaintiff Maria Gomez, claims the Oregon-based athleticwear company did not properly secure personally identifiable information stored within its systems, exposing sensitive consumer data to unauthorized access. The compromised information allegedly includes names, email addresses, billing addresses, phone numbers, transaction records and payment card details.

The lawsuit seeks to represent individuals across the United States whose personal information was impacted by the breach. It alleges the cyberattack stemmed from an inadequately protected network and describes the incident as preventable.

Court filings state the breach was identified on Jan. 21, 2026, but affected individuals were not notified until Feb. 25, more than a month later. During that period, the attackers are said to have released approximately 1.4 terabytes of stolen data online.

Gomez contends that customers remained unaware of the breach until notification letters were issued, by which time their data had already been exposed. The complaint asserts that the company failed to take reasonable measures to safeguard consumer information and delayed disclosure of the incident.

The lawsuit further alleges that the company’s conduct constitutes negligence and a breach of implied contract, arguing that customers entrusted their data with the expectation it would be adequately protected. It also claims unjust enrichment, asserting the company benefited financially while failing to secure user data.

The filing warns that affected individuals now face an increased risk of identity theft and fraud as a result of the breach.