A class-action lawsuit alleges that Nike failed to protect sensitive information and waited too long before notifying customers about a data breach in January, according to court documents.
Lead plaintiff Maria Gomez, of Los Angeles County, California, filed the proposed class action suit on March 24 in U.S. District Court for the District of Oregon, according to Bloomberg Law News. The complaint alleges that the sports apparel giant breached its duties under common law, contract law, industry standards, and the Federal Trade Commission Act to implement reasonable and adequate data security measures.
According to The Oregonian, the lawsuit claims that Nike discovered the breach around Jan. 21, 2026, but did not notify victims until more than a month later (Feb. 25).
Court documents state that information exposed in the breach included names, email addresses, billing addresses, phone numbers and payment card information, according to a Nike notice referenced in the lawsuit.
The lawsuit claims that Nike’s handling of the incident amounts to negligence, breach of implied contract and unjust enrichment, KPTV reported. It also raises California privacy claims on behalf of a proposed California subclass and asks a judge to order additional security measures.
“Plaintiff is very concerned and worried that her Private Information is now in the hands of cybercriminals,” the complaint stated.
Nike declined to comment, The Oregonian reported.
But in a statement provided during initial coverage of the data breach last week, Nike said that “no full payment card details or account credentials were accessed,” KPTV reported.
“Nike immediately worked with law enforcement and leading cybersecurity experts, took steps to strengthen protections, and provided notifications and support as appropriate to impacted individuals,” the company said in the statement.
The class-action suit seeks at least $5 million in damages, including credit monitoring services for victims, according to The Oregonian.
© 2025 Cox Media Group
