A threat actor is claiming to have released a first batch of customer order data allegedly stolen from Al’s Sporting Goods, a U.S. outdoor recreation and sporting goods retailer. The listing, published on June 27, 2026, claims to contain 29,253 order records affecting 20,678 unique customers, with the actor alleging that an additional 1.87 million records will be released later. The claims remain unverified at the time of publication.
Founded in 1921, Al’s Sporting Goods operates retail locations and an online store offering outdoor apparel, footwear, camping equipment, hunting gear, fishing supplies, skiing equipment, and other recreational products.
First batch allegedly contains customer order information
According to the threat actor, the released dataset contains customer order records rather than full payment card information. The listing claims the current batch includes order numbers, customer names, email addresses, billing street addresses, cities, states, ZIP codes, payment methods, card brands, the last four digits of payment cards where applicable, and total order values.
Sample records shared with the listing include purchases paid through both credit cards and PayPal. While the examples do not expose complete payment card numbers, the combination of contact information, billing addresses, purchase history, and partial payment details could still present security and privacy risks if authentic.
Threat actor claims additional data will follow
Beyond the initial release, the threat actor alleges that another 1,869,652 customer order records remain in their possession and will be shared at a later date. No evidence has been provided to independently verify that claim, and the total scope of the alleged breach remains unknown.
The actor also alleges that Al’s Sporting Goods is aware of the incident but has not notified affected customers. However, no evidence was presented to substantiate that assertion.
Retail customer data can support targeted fraud
Although the sample data does not appear to contain full payment card numbers, retail order information can still be valuable to cybercriminals. Customer names, email addresses, billing details, purchasing history, and partial payment information may be used to craft convincing phishing campaigns, impersonate retailers during customer support scams, or facilitate identity theft and account takeover attempts.
The alleged exposure of historical purchase records could also allow attackers to build detailed customer profiles for future social engineering attacks.
No public statement from Al’s Sporting Goods
Al’s Sporting Goods had not issued any public statement at time of publication regarding the alleged breach or the claims made by the threat actor.
As with similar marketplace listings, the claims should be treated as unverified unless independently confirmed by the company or supported by additional technical evidence.
