960TheRef reports:
A class-action lawsuit alleges that Nike failed to protect sensitive information and waited too long before notifying customers about a data breach in January, according to court documents.
Lead plaintiff Maria Gomez, of Los Angeles County, California, filed the proposed class action suit on March 24 in U.S. District Court for the District of Oregon, according to Bloomberg Law News. The complaint alleges that the sports apparel giant breached its duties under common law, contract law, industry standards, and the Federal Trade Commission Act to implement reasonable and adequate data security measures.
According to The Oregonian, the lawsuit claims that Nike discovered the breach around Jan. 21, 2026, but did not notify victims until more than a month later (Feb. 25).
Court documents state that information exposed in the breach included names, email addresses, billing addresses, phone numbers and payment card information, according to a Nike notice referenced in the lawsuit.
Read more at 960TheRef.
Do notifications one month later warrant a lawsuit? In most states, a one-month notice period complies with state data breach notification laws. In California, it is now 30 days from discovery of a breach, but that can be extended for law enforcement or necessary investigation by the victim.
