Varsity Brands breach exposed data of more than 65,000 people

Varsity Brands, the Texas-based parent of BSN Sports and Varsity Spirit, told state regulators in October 2024 that a cyberattack five months earlier had exposed personal information belonging to more than 65,000 people.

According to the company's filing with the Maine attorney general's office, the intrusion took place on May 22, 2024 and was detected two days later, when unusual activity was spotted on internal systems. The filing categorized the incident as an external system breach. Varsity said it moved quickly to stop the activity and took certain systems offline, then brought in outside cybersecurity specialists and notified law enforcement.

The subsequent review found that a limited set of company files containing personal information had been accessed. The data varied by individual and could include names, Social Security numbers, dates of birth, driver's license and other government-issued identification numbers, financial account information, medical and health insurance details, and employee identification numbers. Varsity offered those affected 24 months of complimentary credit monitoring and identity theft protection.

No ransomware group publicly claimed the attack. SecurityWeek reported that the company's brief description was consistent with ransomware but that Varsity declined to comment on whether extortion was involved. The company, which employs roughly 9,000 people, had been sold by Bain Capital to KKR in August 2024, and had appointed its first chief security officer in July. Class action law firms began advertising investigations within days of the notifications going out.