Running Warehouse runningwarehouse.com

Running Warehouse data breach: what happened and what to do

Running Warehouse reported a hacking incident that began October 1, 2021 and exposed customers' names with payment card numbers and security codes. Reports put the total at about 1.8 million customers across four affiliated sites. Notices went out in December 2021.

View all 13,177 breaches
Breach date
Oct 2021
Made public
18 Dec 2021
Data exposed
Names, Credit cards
Last updated

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Running Warehouse is one of four affiliated online sports gear shops (with Tennis Warehouse) that reported the same card-theft incident. The California Attorney General's breach list shows a breach date of October 1, 2021 and a notice filed on December 18, 2021. A filing with the Maine Attorney General says the company found the problem on November 29, 2021 and mailed notices on December 16, 2021. It describes an external hacking incident. The notices don't describe how the attackers got in.

News coverage of the filings puts the total at about 1.8 million customers across the affiliated sites. That figure covers all of them, not Running Warehouse alone.

Sources checked: oag.ca.gov, maine.gov, bitdefender.com.au

Last verified against the official page:

How we research this Report an error

What was exposed

The Maine filing lists a name together with a payment card number and security code. Coverage of the incident also mentions financial account numbers and website account passwords, but the filing lists only the card data. A card number with its security code is enough to make purchases online until the card is replaced.

The company's response

The filing says no credit monitoring or identity theft protection was offered, and press coverage notes customers complained about that. If you shopped at Running Warehouse in 2021 and got a letter, the card named in it is the one to deal with first.

What this means for you

Stolen card data is mostly used for fraudulent charges. Your Social Security number wasn't listed in the filing, so a credit freeze is a precaution rather than a response to this specific leak. A reused password is a different risk: if you used the same one elsewhere, change it there too.

What to do if you were in it

  1. 1

    Ask your card issuer about replacing the card

    If you paid at Running Warehouse around late 2021, call the number on the back of your card and ask about a new card number. The FTC says to report fraud you spot to your card issuer and at identitytheft.gov.

  2. 2

    Read your statements line by line

    Look for small test charges and anything you don't recognize, and dispute them with the issuer right away. Turn on transaction alerts in your bank's app if it offers them.

  3. 3

    Change the password you used on the site

    If you had an account there, change its password and any other account that shares it. Turn on two-factor login where it's offered.

  4. 4

    Consider a credit freeze

    The filing doesn't list identity numbers, so this is optional. The FTC says a freeze is free and you place it separately at Equifax, Experian and TransUnion.

  5. 5

    Check whether your email or phone is in this and other breaches

    Run a free Serus scan to see whether your details show up in known breaches. Serus monitors breach databases and the dark web and alerts you, but it can't remove data from a breach.

Official filings

Timeline

  1. The breach happened

  2. Reported to the Washington Attorney General

  3. The company made it public

  4. Reported to the California Attorney General

Frequently asked

Was I affected by the Running Warehouse breach?

If you bought from Running Warehouse in 2021 you may have been. Companies had to notify affected customers, so a letter or email from December 2021 is the best sign.

What was exposed?

The Maine Attorney General filing lists a name with a card number and security code. Passwords were mentioned in press coverage but not in the filing.

How many people were affected?

News coverage reports about 1.8 million customers across the four affiliated sites. The filings give no separate figure for each site.

Should I change my password?

Yes, if you had an account on the site and reused that password elsewhere. Use a unique password for each account.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Serus

Check if you're exposed in a breach with Serus

Find your leaks. Get alerted to new ones.

Run a free scan

Related articles

All articles

How to know if you have been hacked – 12 signs

How to Prevent Data Breaches in 8 Ways

How to Get My Information Off the Dark Web

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.