Hibbett, owned by JD Sports, is notifying employees that an unknown third party gained unauthorized access to its internal systems and may have acquired files containing personnel records during an April 2026 security incident. The company said in a breach notification dated September 8, 2026, that it detected suspicious activity on its computer network and responded by securing its systems, notifying law enforcement, and engaging external forensic cybersecurity experts to investigate.
Hibbett said in the notification, “We recently discovered suspicious activity in our computer network. Upon discovery, we initiated an investigation, notified law enforcement, and secured our systems. We also engaged external forensic cybersecurity experts to assist with the investigation and ensure the security of our computer systems. The forensic investigation determined that an unknown third party gained unauthorized access to our computer systems between April 22, 2026 and April 25, 2026. During that time, the third party may have accessed and acquired certain files without our network, including personal records that we maintain for HR purposes related to current and former employees and their dependent, and/or beneficiaries. Over the past few months, we have been conducting an in-depth review of these records.”

Following the intrusion, Hibbett said it spent several months conducting an in-depth review of the affected records to determine what information was involved and identify individuals requiring notification. The redacted notification states that the affected records contained the recipient’s name and additional personal information, although the specific additional data element is obscured in the supplied copy.

Hibbett said it is not aware of any fraud or identity theft resulting from the incident. Impacted individuals are being offered a complimentary one-year Experian IdentityWorks Credit 3B membership, providing monitoring across Experian, Equifax, and TransUnion, identity restoration assistance, and up to $1 million in identity-theft insurance.

The company has not disclosed how the attacker initially gained access to its network, and the notification does not characterize the incident as ransomware.

At the time of writing, no ransomware group or data-extortion operation has publicly claimed responsibility for the attack.

Affected individuals were encouraged  consider enrolling in the offered monitoring service and closely watch their financial and credit accounts for suspicious activity. Those concerned that their information could be misused can also consider placing a fraud alert or security freeze on their credit files.

Image courtesy Hibbett