Adidas suffers data breach after customer support provider is hacked, user information compromised

Adidas confirms that user data was compromised after a breach at one of its third-party customer support vendors. The exposed information includes names, email addresses, and phone numbers of users who contacted Adidas for support. No passwords or payment data were affected, according to the company.

Following the breach disclosed on May 27, 2025, Adidas says it launched containment measures and began working with cybersecurity experts to investigate the incident. The company is notifying affected users and has reported the breach to data protection regulators and law enforcement, as required by law.

The breach highlights a broader problem as third-party vendors continue to be a weak point in enterprise security. Verizon’s 2025 Data Breach Investigations Report found that 30% of breaches last year involved external service providers, raising ongoing concerns around vendor risk management and security oversight.

Adidas isn’t the only retailer facing fallout from vendor-related breaches. In 2023, JD Sports reported that attackers had accessed data from about 10 million customers, including names, contact details, and order history. A year later, Foot Locker disclosed a similar breach linked to a third-party marketing partner.

Both incidents fuel ongoing concerns about how external vendors manage customer data, and why they remain a persistent weak spot in retail cybersecurity.

This also isn’t the first time Adidas has dealt with a data breach. Earlier this year, customer information was also exposed in separate incidents reported in Turkey and South Korea. Adidas says it regrets the incident and is working to strengthen its data security posture. The company adds that efforts to investigate the breach and prevent similar issues going forward are ongoing. 

While Adidas has not issued specific guidance for affected users, standard cybersecurity best practices include verifying the source of unsolicited messages and monitoring accounts for unusual activity.