What: Adidas reports customer service data breach through third-party provider, joining a wave of major retailers recently targeted by cyber attacks.

Why it is important: This breach, following recent attacks on M&S, Harrods, and Co-op, highlights the growing vulnerability of retail supply chains to third-party security breaches, which now account for 41% of reported incidents.

Adidas has disclosed a significant cyber security breach where unauthorized external parties accessed customer data through a third-party customer service provider. The compromised information primarily consists of contact details from customers who had previously engaged with Adidas's customer service. The sportswear giant has confirmed that no passwords, credit card information, or other payment-related data were exposed in the breach. The company has responded swiftly by implementing containment measures and launching a comprehensive investigation in collaboration with leading information security experts. Adidas is actively notifying affected customers and has engaged with relevant data protection authorities and law enforcement agencies. This incident follows a series of cyber attacks targeting prominent retailers, including Marks & Spencer, which recently projected a GBP 300 million profit impact from a similar breach.

IADS Notes: Recent data reveals an alarming trend in retail cyber security breaches. In April 2025, ransomware attacks accounted for 30% of retail security incidents, with average losses reaching GBP 1.4 million per attack. The impact has been particularly severe, as demonstrated by M&S's GBP 300 million profit hit in May 2025. This wave of attacks has transformed the cyber insurance landscape, driving a 10% increase in premiums across the UK retail sector. The growing sophistication of these threats is evident in the targeting of third-party providers, which now account for 41% of reported breaches, highlighting the complex challenge retailers face in securing their extended digital ecosystem.

Adidas hit by cyber-attack as customer data stolen