Nike Alleged Breach: Threat Actors Claim Leak of Millions of Customer Records

A threat actor on a prominent cybercrime forum has claimed responsibility for leaking data allegedly belonging to Nike and Alcon, posting the purported datasets for download.

The claims, currently unverified, suggest a significant breach affecting millions of records across both organizations.

Nike Alleged Breach

According to the forum post, the threat actor alleges the Nike-related leak contains customer data spanning eight figures in total line count, meaning tens of millions of individual records.

The actor claims the dataset includes recent customer registrations and order-related information dated from 2026, indicating the data may be relatively fresh rather than recycled from older breaches.

The leaked material is reportedly packaged as a 7z archive containing CSV files with user data. The 7z format, known for its high compression ratios, is commonly used by threat actors to package large datasets for easier distribution on forums and marketplaces.

If accurate, the inclusion of order-related records could mean exposed data spans purchase history, account details, and potentially personally identifiable information (PII) tied to Nike’s customer base.

The official alert detailing the sample file trees, metadata markers, and target profiles was disseminated natively by Dark Web Informer (@DarkWebInformer) on X.

The same actor claims a parallel leak involving Swiss eye-care company Alcon, describing a broader and more varied dataset. This dual-targeting approach shadows an ongoing surge in corporate extortion campaigns throughout 2026.

For example, security analysts are closely tracking modern initial access vectors, such as how threat groups target critical vulnerabilities in edge infrastructure to pivot into corporate databases. The alleged Alcon leak reportedly includes:

• User Account Data: Granular login credentials and customer portal metrics.
• MARLO Signup Records: Patient and specialty portal registration profiles.
• Salesforce Integrations: Vendor and supplier data tied directly to internal supply chain channels.
• Development Assets: Internal conversation logs, order histories, and proprietary source code files.

Alleged Victim Target	Purported Asset Class Exposed	File Structure Format	Reported Volumetric Scale
Nike	Customer PII, registration dates, order histories	7z compressed archive (CSV logs)	Tens of millions of rows
Alcon	Source code, Salesforce logs, customer signups	Broad development directory tree	Combined uncompressed 40GB+

The presence of source code alongside customer and supplier data, if verified, would suggest a more extensive compromise potentially involving internal systems rather than just customer-facing databases.

To isolate these multi-stage pivot tactics, enterprises have increasingly turned to AI-driven network detection systems to block lateral unauthorized traffic before data exfiltration occurs.

Salesforce data exposure is particularly notable given the platform’s widespread use in enterprise CRM and supply chain management, raising questions about whether the breach originated from a third-party integration or direct system access.

The threat actor claims the combined Nike and Alcon datasets total over 40GB uncompressed, a substantial volume that, if legitimate, would place this among the more significant retail and healthcare-adjacent data leaks disclosed this year. Neither company has issued a public statement confirming or denying the claims as of this writing.

As with many forum-based breach claims, independent verification remains pending. Threat actors frequently exaggerate scope, recycle old data, or fabricate claims entirely to build reputation or attract buyers.

Organizations named in such claims are advised to conduct internal audits, monitor for anomalous access patterns, and prepare incident response protocols even while verification is ongoing.