The Oregon-based athleticwear titan has landed itself in hot water in an Oregon federal court, with a plaintiff claiming that the brand failed to secure and safeguard consumers’ personally identifiable information during a January data breach.
The lawsuit, filed by complainant Maria Gomez, alleged that Nike did not properly secure the shopper information that it stored within its information network, which ranged from names and emails to billing addresses, phone numbers, transaction data and even payment card specifics.
Now, Gomez wants to take the brand to task through a nationwide class-action suit and is seeking individuals whose privacy was compromised during the breach, which she argued was caused by an “inadequately protected network.”
“With this action, Representative Plaintiff seeks to hold Defendant responsible for the harms it caused and will continue to cause Representative Plaintiff and other similarly situated persons in the massive and preventable cyberattack purportedly discovered by Defendant on January 21, 2026,” the lawsuit read.
In addition to inadvertently allowing bad actors access to the sensitive information, Nike also neglected to alert shoppers to the data breach in a timely manner, the suit said. Affected parties were informed on Feb. 25, over a month after Nike claims it unearthed the issue. What’s more, the individuals responsible for the ransomware attack released 1.4 terabytes of the Nike data on its website.
Lawyers for Gomez wrote that she and other class action members were “wholly unaware” of the data breach until Nike’s letters arrived, tardily informing them of the issue after damage had been done. According to the suit, Nike’s actions show that the brand intentionally, willfully, recklessly and/or negligently failed to take reasonable and adequate measures to protect consumer data.
“Plaintiff and all class members are now imminently at risk of crippling future identity theft and fraud,” it read.
Gomez argued in the suit that Nike was derelict in its duty to protect consumer data through the breach of implied contract, and the No. 1 sportswear label was unjustly enriched while its shoppers’ data was compromised. As the first plaintiff in the class-action case, Gomez is demanding a trial by jury as well as declaratory and injunctive relief—that Nike rectify its wrongful actions—as well as an award of punitive damages for herself and other signatories of the suit.
