Online Retailers (Top 10) · Online/Retail (apparel/footwear) · Data breach
Nike (online store)
Headline
Nike had a January 2026 breach (data leaked by an extortion group; Nike attributes it to a third-party provider) plus a second separate finding, and the row is worth reading alongside the Nike Run Club and SNKRS…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Nike had a January 2026 breach (data leaked by an extortion group; Nike attributes it to a third-party provider) plus a second separate finding, and the row is worth reading alongside the Nike Run Club and SNKRS ecosystem: an athletic brand's app collects location traces, workout patterns and biometric-adjacent performance data far beyond what a retailer needs to sell shoes. Running route data specifically has produced real-world security incidents elsewhere in the industry, because a route logged daily from the same starting point identifies a home address and a reliable absence window. See the Data Sharing column for the itemised findings.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
TWO SEPARATE, SERIOUS FINDINGS: (1) A JANUARY 2026 DATA BREACH: an extortion/ransomware group published approximately 1.4 TERABYTES of data that Nike attributes to a third-party service provider. A class action (Gomez v. Nike, Inc., No. 6:26-cv-00564, D. Or., filed March 24, 2026) alleges exposure of names, emails, billing addresses, phone numbers, transaction information and payment card data; Nike states that 'no full payment card details or account credentials were accessed.' The complaint alleges Nike did not notify affected customers until February 25, 2026 — more than a MONTH after discovering the breach on January 21, 2026, which the lawsuit argues 'further exacerbated' the harm since customers had no chance to protect themselves during that window. (2) SEPARATE TRACKING/DATA-SHARING LAWSUITS (Magenheim v. Nike, Inc., No. 9:25-cv-81573-DMM, S.D. Fla., filed Dec. 2025 under Florida privacy and property law, with a jury trial set for Nov. 2, 2026; and Abdullah v. Nike Inc., No. 3:25-cv-10882, N.D. Cal., a California Invasion of Privacy Act suit over Google, Meta and Trade Desk trackers that was voluntarily dismissed on April 27, 2026 after a notice of settlement; a 'Jurdi v. Nike' caption recorded in earlier drafts could not be confirmed) allege Nike's website automatically installs tracking software on visitors' browsers WITHOUT CONSENT, sending behavioral data to Google and Meta for commercial/advertising purposes — one analysis estimated that if Nike tracked as few as 100,000 California residents without consent, potential STATUTORY DAMAGES under California's $5,000-per-violation framework could reach $500 MILLION, illustrating how quickly per-violation statutory damages can scale against a company with Nike's website traffic.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (NKE). Service route: c/o General Counsel / Corporate Secretary, Beaverton, Oregon — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy nike.com/help/a/privacy-policy | Not fetched yet | NO (HTML only) |
| Terms of service nike.com/help/a/terms-of-use | Not fetched yet | NO (HTML only) |
| Website nike.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: Oregon. Provisions of OCPA on file:
| Provision | Type | Source |
|---|---|---|
| Sensitive Data — Expanded Categories Including OR-Specific ORS § 646A.570(18) | hard | source |
| Applicability Threshold ORS § 646A.572 | threshold | source |
| Right to Access ORS § 646A.574(1)(a) | hard | source |
| Right to List of Specific Third Parties ORS § 646A.574(1)(a)(B) | hard | source |
| Right to Data Portability ORS § 646A.574(1)(a)(C), (2) | hard | source |
| Right to Correction ORS § 646A.574(1)(b) | hard | source |
| Right to Deletion ORS § 646A.574(1)(c) | hard | source |
| Right to Opt Out of Sale, Targeted Advertising, and Profiling ORS § 646A.574(1)(d) | hard | source |
| Right to Appeal Denied Request ORS § 646A.576(6) | hard | source |
| 2026 Amendments — Precise Geolocation Sale Ban and Minor Data Sale Prohibition ORS § 646A.578(2)(c)-(d); OR HB 2008 (2025), 2025 Or. Laws ch. 251 | hard | source |
| Privacy Notice Requirements ORS § 646A.578(4) | hard | source |
| Universal Opt-Out Mechanism Required ORS § 646A.578(5)(c) | hard | source |
| Processor Contract Requirements ORS § 646A.581 | hard | source |
| Known Consumers Under 16 — Sale Ban Or. Rev. Stat. § 646A.578(2)(d); 2025 Or. Laws ch. 251 | hard | source |
| Precise Geolocation Data — Sale Ban Or. Rev. Stat. § 646A.578(2)(d); 2025 Or. Laws ch. 251 | hard | source |
| Enforcement — Cure Period Expired Or. Rev. Stat. § 646A.589; 2025 Or. Laws ch. 417, § 5 | hard | source |