The Non-Financial Ledger

Corporate balance sheets measure profit and loss in dollars. They have no column for stolen peace of mind. They cannot quantify the dread that settles in your gut when you learn your personal data, the digital extension of yourself, is now a commodity for criminals. The class-action complaint filed against Under Armour itemizes the theft of data. What it describes is the theft of security, a fundamental human need. For plaintiff Milreace Malone, a former employee, and millions of others, the company’s alleged negligence has imposed a life sentence of constant vigilance.

Every strange email, every suspicious text, every unknown phone call is now a potential threat. The background hum of daily life is now punctuated by spikes of anxiety. Is this a phishing attempt using my stolen data? Is someone trying to open a line of credit in my name? This is the mental tax levied on victims of corporate carelessness. The lawsuit notes Malone has suffered “fear, anxiety, and stress,” a burden compounded by the corporation’s silence. While executives calculated the cost of a public relations response, real people were left to grapple with the fallout alone, their trust in a global brand shattered.

The complaint details the “lost time and opportunity costs associated with attempting to mitigate the actual consequences of the Data Breach.” This is the clinical language for hours stolen from your life. Hours spent on the phone with banks, scrolling through credit reports, changing passwords, and researching how to protect yourself from a threat that should never have existed. This time is unrecoverable. It is time that could have been spent with family, on creative pursuits, or simply at rest. Under Armour’s failure to invest in basic security measures like encryption transferred a debt of time and energy directly onto the people whose data fueled its $5.2 billion revenue stream.

This is a story of profound betrayal. Customers and employees provide their information with a reasonable expectation of stewardship. Under Armour’s own privacy policy, cited in the lawsuit, promises “appropriate technical and organizational safeguards.” This was the bedrock of the agreement. The allegation that this data was left unencrypted is an allegation of a fundamental promise broken. It suggests a corporate culture that prioritized profit margins over the privacy and safety of the human beings it relies on for its existence. The data was an asset to be monetized, but its protection was merely an expense to be minimized.

The ransomware group Everest didn’t just steal data; they stole the feeling of safety in a digital world. The countdown timer they placed on their dark web site is a public clock ticking down on the lives of millions. Under Armour’s alleged failure to protect its systems, and its subsequent failure to warn its community, turned its customers and employees into unwilling participants in a hostage negotiation. The non-financial ledger shows a staggering deficit: a catastrophic loss of trust, a permanent state of anxiety, and the quiet, grinding theft of personal time, all written off in the name of corporate profit.

Societal Impact Mapping

Legal Receipts

The following are direct statements and quotes from the Class Action Complaint, Case 1:25-cv-03857-EA, filed in the United States District Court for the District of Maryland. This is the evidence.

Everest published on its dark web leak site that it stole 343 GB of internal company data, employee information, along with personal data of millions from various countries. Everest also published sample data to prove the authenticity of their claims. Everest has issued a demand to Defendant to make contact with Everest within seven days, and Everest has published a countdown timer until “time runs out”.

To date, Defendant has yet to issue any public disclosure about the Data Breach.

Defendant failed to adequately protect Plaintiff’s and Class Members’ Private Information––and failed to even encrypt or redact this highly sensitive information. This unencrypted, unredacted Private Information was compromised due to Defendant’s negligent and/or careless acts and omissions and their utter failure to protect Plaintiff’s and Class Members’ sensitive data.

From Under Armour’s own Privacy Policy: “We implement appropriate technical and organizational safeguards to protect against unauthorized or unlawful processing of personal data and against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.”

Plaintiff and Class Members have suffered injury as a result of Defendant’s conduct. These injuries include: (i) invasion of privacy; (ii) theft of their Private Information; (iii) lost or diminished value of Private Information; (iv) lost time and opportunity costs associated with attempting to mitigate the actual consequences of the Data Breach; … and (viii) the continued and certainly increased risk to their Private Information…

Quoting the U.S. Government Accountability Office: “[L]aw enforcement officials told us that in some cases, stolen data may be held for up to a year or more before being used to commit identity theft. Further, once stolen data have been sold or posted on the Web, fraudulent use of that information may continue for years.”

Defendant enriched itself by saving the costs it reasonably should have expended on data security measures to secure Plaintiff’s and Class Members’ Personal Information. Instead of providing a reasonable level of security that would have prevented the hacking incident, Defendant instead calculated to increase its own profit at the expense of Plaintiff and Class Members by utilizing cheaper, ineffective security measures and diverting those funds to its own profit.

What Now?

The individuals whose data was allegedly left exposed are now combatants in a war they did not choose. While the legal system slowly grinds forward, the risk is immediate. The following entities bear responsibility and require public pressure.

Corporate Roles Under Scrutiny

While specific executive names are not in this legal filing, the responsibility for this catastrophic failure rests with the highest levels of corporate leadership.

• Chief Executive Officer
• Chief Technology Officer
• Chief Information Security Officer
• The Board of Directors

Regulatory Watchlist

These government bodies have the power to investigate and penalize corporate negligence on a scale that forces change. They are the public’s primary defense against corporate malfeasance.

The Resistance

Waiting for corporate or government action is not enough. Power is built from the ground up. Support data privacy advocacy groups fighting for stronger laws and corporate accountability. Share this story to pierce the corporate silence. Engage in local organizing and mutual aid networks that help people who have become victims of identity theft. The corporation views your data as a line item on a spreadsheet. We must treat its protection as a non-negotiable right and fight back when that right is violated.