What happened

Adidas confirmed in a public notice published around May 23, 2025 that it had suffered a data breach originating not from its own systems, but from a third-party customer service provider that helps handle inquiries directed to the company's help desk. The disclosure followed reports in April 2025 that attackers had compromised the vendor's systems and accessed data belonging to Adidas customers who had previously contacted support.

Adidas said the breach was limited to the vendor's environment and that its own core corporate network and e-commerce infrastructure were not directly compromised, a containment outcome the company attributed in part to the third-party provider's systems being segmented from Adidas's internal network.

Scope of the breach

The incident did not hit Adidas globally in one disclosure; instead, the company issued a series of regional notifications over the following months as its investigation, and the attackers' own claims, expanded to cover additional markets. Adidas confirmed impact to customers in Turkey and South Korea, posting notices on both its German and English-language corporate sites, while leaving some ambiguity for a period about whether U.S. or EU customers were also affected, or whether that represented a separate incident within the same vendor.

The company was clear that no payment card numbers or account passwords were exposed. Instead, the exposed information was limited to contact data that customers had voluntarily submitted when reaching out to Adidas's help desk: names, email addresses, and phone numbers. No purchase history, government ID numbers, or financial account details were reported as part of the exposure.

Attribution and the broader campaign

While Adidas itself did not formally name the attackers responsible, security researchers linked the breach to the extortion group ShinyHunters, which conducted a sweeping 2025 campaign against organizations using third-party CRM and customer-service platforms. That same campaign, built substantially around vishing and other social engineering techniques targeting help-desk and support staff, also compromised customer data at Google, Cisco, Workday, Louis Vuitton, Gucci, Dior, Tiffany & Co., Chanel, Qantas, and Jaguar Land Rover, among others, making Adidas one of many retail and luxury brands swept up in the same wave.

The pattern in this campaign was consistent across victims: rather than attacking the well-defended networks of large retailers and technology companies directly, attackers targeted the smaller, often less rigorously secured vendors and contractors those companies rely on for customer service, marketing, or CRM functions — a classic supply-chain approach that let attackers reach large volumes of customer contact data by compromising a single weaker link.

Response and remediation

Adidas said it responded by containing the incident, engaging outside cybersecurity experts to investigate, and notifying both affected customers and relevant data protection authorities as required under applicable privacy law, including in jurisdictions covered by GDPR-style notification obligations. The company published consumer-facing guidance urging affected customers to be cautious of unsolicited emails, calls, or text messages referencing their Adidas account or support history, warning that such messages could be used in follow-on phishing attempts using the stolen contact details to appear legitimate.

Adidas also emphasized, consistent with the confirmed scope of the breach, that customers did not need to change payment information or passwords as a direct result of this specific incident, since no such credentials were exposed — though general password hygiene and vigilance against phishing were still recommended.

Why it matters

The Adidas breach became one of the clearer illustrations from 2025 of how a company's own security investment can be undermined by a comparatively minor supporting vendor. Even with Adidas's core network reportedly untouched, the breach still generated real consumer harm and regulatory exposure purely because a third party handling customer inquiries was compromised — reinforcing a broader industry push toward stricter vendor risk assessments, contractual security requirements, and network segmentation between brands and the contractors who serve their customers.

A rolling, multi-region disclosure

Because Adidas operates through a mix of regional web properties and franchise arrangements, its breach did not unfold as a single global announcement but as a series of country-specific notices published over subsequent weeks, each confirming impact to a different customer population. This rolling disclosure pattern left some ambiguity in the early press cycle about whether reports concerning different regions, such as Turkey, South Korea, and later markets, described a single underlying vendor compromise or several related incidents affecting the same third-party provider across multiple Adidas markets. Adidas's own statements consistently pointed back to the same root cause: a single compromised customer-service vendor whose access spanned multiple regional Adidas support operations.

Part of the broader luxury and retail wave

Adidas's experience closely paralleled breaches disclosed around the same period at other major consumer brands, including Louis Vuitton, which also suffered multi-country exposure of customer data attributed to the same ShinyHunters-linked campaign, and Gucci and other luxury houses under the same corporate umbrellas. Security researchers noted that the retail and luxury sector's heavy reliance on outsourced customer-service call centers and support ticketing platforms made it a particularly attractive target for a campaign built around compromising exactly those kinds of third-party systems, since a single successful intrusion into a shared vendor could yield customer data belonging to several unrelated retail brands at once.

Ongoing scrutiny

Beyond the 2025 incident, Adidas has continued to face scrutiny over third-party data handling; a separate investigation into a further alleged third-party data exposure, reported in the months that followed, kept the company's vendor-security practices in the spotlight well after the original breach notifications went out. That continued attention reflects a broader pattern seen across the retail sector, where a single vendor compromise can generate follow-on disclosures and investigations extending well beyond the initial incident window.