Buy Me a Coffee

Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Logo Nike, Inc.

Group: Worldleaks

Discovered by ransomware.live: 2026-01-22

Estimated attack date: 2026-01-22

Country: US

Description:

[AI generated] Nike, Inc. is a globally recognized sports apparel and equipment company headquartered in Beaverton, Oregon, USA. Founded in 1964 as "Blue Ribbon Sports" by Bill Bowerman and Phil Knight, it officially became Nike, Inc. in 1971. Known for its iconic "Swoosh" logo and "Just Do It" slogan, Nike offers comprehensive collections of sportswear, sports equipment, accessories, and services for a variety of sports.


🕵️ Infostealer activity detected by HudsonRock

Compromised Employees: 220

Compromised Users: 481183

Third Party Employee Credentials: 444


External Attack Surface: 200


Infostealer Distribution


DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abusecomplaints@markmonitor.com
  • internet.domain.administrator@nike.com
  • whoisrequest@markmonitor.com
MX Records
  • mxb-001b6002.gslb.pphosted.com.
  • mxa-001b6002.gslb.pphosted.com.
TXT Records
  • apple-domain-verification=FIPflKu9G6kEqyab
  • wiz-domain-verification=3cb6d690698de9ba2001d69ed35811baa3f917302293875949b7d863d1bf8b27
  • _3m4ex27y3mflwhlg4u1tmecdcn5ybcr
  • _globalsign-domain-verification=oTFxDWw1mdzzP-Zd45wwC6Ifc6nSakWOmRQSYD_XHz
  • _z9yb4dkbcwn7z68zbmcju1hzw2bdtx9
  • jamf-site-verification=aIUTcaWCojh8ldgWpayjCg
  • cisco-ci-domain-verification=7ab30713f81d07c44eea6bc370f3a51f2ca7d6c0477a8db10974320ec4bef38f
  • stripe-verification=c814f4607c0171c39868805fb1ae7723a2d91d54b0c3149eb8ec46aad7a7be6f
  • mongodb-site-verification=POJ3Ib5m6oOyqX91ZrlgcbAFVKwRhMml
  • Validation no ext
  • ZOOM_verify_sCcWC00VT72Xd3cKn3ByDQ
  • scnv-verification=03fe4bf81654621682a5c049867fccb4:4fa32facf3797aa643beb4108a6c956c:d986a0a5e1ca4ceb8941e8d9ed54eb11
  • stripe-verification=3e045226dd7579f3fea910186ec8aee832e44fecd5d5e89f690efed18c3f38fd
  • github-verification=9rQmuxzyEyx4yq7LjueTPBmTFPNf9xcMKDBpDkkw
  • google-site-verification=JjQcml7P2JjvkTRFwUtkeEGy6-Pehs-zJ3YC2bVcCp4
  • Dynatrace-site-verification=3767faff-af76-492b-b89a-8a131cf04b79__c6r5amr4k70b0if4kb7758iej7
  • 4784qfgb1p5cygmgsszmv4bnfqmk7kct
  • MS=ms93873368
  • v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all
  • google-site-verification=0tcT2lcGC5FZjgDR2BU_t4PwfRpG5TdMC3W7Uq8tleI
  • atlassian-domain-verification=pJlgODoOXqMpfPHoasf4sPWDltyOP4cWVg6ptKTMfoozopE7QCq/a8TYq65TmOxv
  • cloudhealth=a8cf6829-a2b8-4f9f-9945-f71659ede7ff
  • docker-verification=278531f6-37fe-485c-89db-334e7b913aa0
  • rhino_accounts=f8b043ccf0f03789479ad9ba4d169b0d
  • amazonses:guDcMedRx3D3yaitJGO/aV+NzhugJRiKDDdKbUXqbLM=
  • adobe-idp-site-verification=6f949b65-8b97-4bb1-be7a-6088c7b96a98
  • atlassian-sending-domain-verification=addc73ef-6fc8-4d74-a015-9b63ec7809a1
  • 6IHSYqvkFCDiMubO/Czv+XdVcUWb8weKG9uyqn9Kh0u3RZwA+xx73W/f+iQrSciT+peqOK3yNcx1jsIqsHgY+g==
  • 52b0ba4a752984fe5aadf8307d978aaad69cc5e0dc654a2f6f011c210bc3d0f8
  • google-site-verification=Ot6fp-6zJPJw5lHQXZm5Lhs3nCmRp7EW2eHn5htn_3A
  • vmware-cloud-verification-b6516934-01c2-4ad1-bedd-11420be6e415
  • cursor-domain-verification-gba5jn=lRd0T4XTIOjBR3FYBvBcEMw9k
  • pendo-domain-verification=suZZiVajeuV3K-TVqdF0B7QS9o0
  • soa header update
  • validation and verification zone
  • google-site-verification=AqwT-_WzscdFOiacOoMpw-aMjwRDmJLuT9cHH3zFfkw
  • dtm-domain-verification=LmCPecEAhn9C-gGneNj_stFVbTTrES0EtZTslr2YF2c
  • validate post vanity
  • facebook-domain-verification=9qrf9w3jjvoc7r3ry2mv6fds4qd9jd
Cloud / SaaS Services Detected
Adobe Apple Atlassian Amazon SES/WorkMail Microsoft 365 Stripe JamF Cisco Proofpoint Zoom

Leak Screenshot:

Leak Screenshot