Nike probes suspected cyber attack after data leak claim

Nike has begun an internal investigation into a suspected cyber attack after a hacker group claimed it had accessed and leaked a large volume of the sportswear brand's internal data, prompting fresh warnings from security specialists about resilience and data exposure at global companies.

The Oregon-based company has not yet confirmed the scale or validity of the reported breach. The incident comes amid a steady rise in attacks on consumer brands and retailers that hold extensive customer, employee and partner information.

The hacker group has claimed access to terabytes of Nike's internal information. The claims have raised questions about the sensitivity of data potentially at risk, including intellectual property and confidential commercial material.

Nike has launched an internal probe into the incident and is assessing whether any critical systems, core intellectual property or commercial operations have been affected.

The company operates complex global technology environments. These include widespread use of cloud-based productivity and collaboration platforms, which often sit at the centre of business processes, product development and supply chain coordination.

Recovery focus

Security specialists said Nike will now move quickly to understand whether attackers gained access to sensitive intellectual property, internal systems or production environments, and what changes they may have made if they entered live platforms.

One expert said the main challenge for large organisations in incidents of this type lies in the recovery phase. This includes identifying not only what data may have been copied, but also what configurations and system settings may have been altered or removed during the intrusion.

CoreView, which works with enterprises that use Microsoft 365, said complex environments can make this process lengthy.

"Nike will be running fast to identify if critical IP and systems have been exposed. The biggest challenge in moments like this is the recovery process. When attackers get in, they often go after data, but also they increasingly delete and tamper with configurations. Nike will need to do a full audit to see what's changed and may have to reconfigure their environments - something that can take weeks in a big complex environment like Microsoft 365. Stopping attackers at the start matters, but in a long race, resilience is defined by the ability to withstand impact, respond under pressure and recover at machine speed," said Rob Edmondson, Director of Product, CoreView.

Security teams in such incidents typically conduct audits across user access, identity systems and configuration baselines. They may also roll back settings, revoke tokens, rotate credentials and tighten controls on exposed accounts and services.

Large enterprises often run multiple overlapping systems. That can complicate investigations as teams look for lateral movement, hidden persistence mechanisms and evidence of configuration tampering across cloud tenants and on-premise services.

Data exposure

Commentators said the Nike case underlines how a suspected cyber attack can quickly turn into a broader data incident that reaches far beyond a single system or database.

ManageEngine, the IT division of Zoho, said the potential exposure of internal corporate information often has wider and longer-lasting consequences than the immediate operational impact of an attack on production systems.

"Nike's suspected attack shows how quickly a cyber incident becomes a data issue. When attackers claim access to terabytes of internal information, the immediate concern is for operational disruption, but this is rapidly superseded by privacy concerns, with sensitive business and partner data potentially being exposed. For large brands, the risk rarely stops at customer records. Product roadmaps, supplier contracts, pricing models and internal comms are often just as valuable to attackers. A leak of this scale can create long-term competitive and reputational damage, even before the facts are fully confirmed. Data breaches now move well beyond the perimeter of a single organisation. Access is shared across suppliers, platforms and wholesale partners, increasing the blast radius when something goes wrong. Security strategies have to reflect that reality, with tighter control over data access, continuous monitoring and faster visibility when unusual behaviour appears. Limiting how far attackers can see and how much they can take makes a critical difference," said Shankar Haridas, Head of UKI, ManageEngine.

Global brands now share data across extended supply chains, logistics providers, retail partners and cloud platforms. This trend expands the so-called blast radius of an incident and can draw in organisations that sit several steps away from the original target.

Security teams in large companies have been shifting towards closer control over who can see what information. Many are moving towards continuous monitoring of user behaviour and automated alerts when abnormal patterns or data flows occur.

Wider scrutiny

The Nike probe is likely to face close attention from regulators, privacy advocates and partners. Any confirmed leak of personal data, supplier information or internal commercial documents could trigger mandatory notifications in multiple jurisdictions.

Consumer groups and privacy regulators have increased scrutiny of how global brands store, move and protect data. They are also watching how quickly companies disclose and remediate incidents.

Security analysts said organisations that rely heavily on cloud productivity platforms often need detailed tenant-level visibility and the ability to compare current configurations with known-good baselines. They also need rapid response mechanisms that can disable compromised access and restore secure settings.

"Stopping attackers at the start matters, but in a long race, resilience is defined by the ability to withstand impact, respond under pressure and recover at machine speed," said Edmondson.