Sports Warehouse (Running Warehouse) Pays New York $300,000 Over 2021 Breach

Sports Warehouse Inc., the parent of Running Warehouse, Tennis Warehouse, Skate Warehouse and Tackle Warehouse, paid New York $300,000 in May 2023 to settle findings that weak security let an attacker reach payment card data for nearly every purchase made on its sites since 2002. The companies also spent more than two years in federal court defending the resulting class claims, which ended in an order sending customers to arbitration instead of a jury.

What the New York Attorney General found

New York Attorney General Letitia James announced the settlement on May 25, 2023. After reaching the servers, the attacker planted several web shells for ongoing remote access to Sports Warehouse's commerce server. The companies' own investigation also found the attacker had reached some customers' email addresses and passwords.

The Attorney General's office put a number on the exposure: That is the specific figure stated in the body of the release; its headline and opening paragraph instead round the exposure to "2.5 million consumers" and describe credit card and email data for "more than 136,000 New Yorkers" — the release does not reconcile the two framings, and this page states both rather than picking one.

The office's finding on cause was direct: Attorney General James said in the release that .

What the settlement requires

Beyond the $300,000 penalty, New York's agreement requires Sports Warehouse to run an information-security program with regular updates reported to its leadership, encrypt the private information it holds, strengthen customer password rules and hash all stored passwords, run a penetration-testing program, and collect and keep only the data it needs for legitimate business purposes. None of the office's findings name an individual at the company; the settlement is with the corporate entities.

The federal claims and the arbitration ruling

Sports Warehouse's customers filed a run of federal class claims over the same incident in late 2021 and early 2022, including John Patrick v. Running Warehouse, LLC, filed in the Central District of California on December 29, 2021, and Bethany Buffington v. Running Warehouse, LLC, filed the same day in the same court. Buffington's claim was later taken up on appeal: the Ninth Circuit Court of Appeals docketed Bethany Buffington v. Running Warehouse, LLC on November 21, 2022.

Bloomberg Law reported on February 12, 2024 that the appeals court's ruling meant the consumer claimants , over an October 2021 data breach. The companies named as defendants were Running Warehouse LLC, Wilderness Sports Warehouse LLC, Skate Warehouse LLC and Sports Warehouse LLC. The report said the panel found the customers had sufficient notice of the arbitration clause in the companies' website terms, and that the lower court had properly upheld it as valid. The outcome moved the claims out of court entirely rather than resolving them for or against either side; no financial result from the arbitration itself is on the public record as of this page's publication.

What isn't on the record

Neither the New York settlement nor the litigation record reviewed for this page states a specific calendar date the intrusion began or ended, how it was discovered, or whether any customer has reported confirmed financial fraud tied to this incident. Sports Warehouse has no security-leadership record yet on CISO Tribune, the network's mothership site.

FAQ

What happened in the Running Warehouse data breach? An attacker reached Sports Warehouse's servers in 2021 by repeatedly guessing login credentials, then installed web shells to reach the company's commerce server, which held payment card data going back to 2002.

How many people were affected by the Running Warehouse data breach? New York's Attorney General put the number at as many as 1,813,224 consumers' payment card data and 1,180,939 consumers' login credentials, while the same release's own headline rounds the total to 2.5 million consumers.

Did Running Warehouse pay a fine over the data breach? Its parent, Sports Warehouse Inc., paid New York $300,000 in penalties in May 2023 and agreed to specific security upgrades, including encryption, password hashing and penetration testing.

What happened to the customer claims against Running Warehouse? Federal claims filed in late 2021 and early 2022 were compelled into arbitration; the Ninth Circuit Court of Appeals upheld that outcome in a ruling reported February 12, 2024.

Is this the same as an SEC filing? No. Sports Warehouse is privately held and has no SEC Item 1.05 disclosure on EDGAR; this page's facts come from a state attorney general settlement and federal court dockets instead. See this site's guide to state breach-notification laws for how that reporting path differs from the SEC's.

For more companies with both a disclosed incident and related litigation, see the data-breach class-action litigation tracker and the breach outcomes cross-reference.