AccidentalMisconfigurationData ExfiltratedCustomer Data InvolvedFINANCIAL_ACCOUNTFINANCIAL_CREDENTIALSLowContained
SPay Inc
bd_443fdcd624ea3269 · schema v1 · pii pii-v1
Full breach record for SPay Inc →SPay Inc (dba Stack Sports) notified Massachusetts residents of a cybersecurity incident involving its Sports Affinity web application. Unauthorized code was placed on the platform between May 8 and June 10, 2026, capturing payment card details (numbers, CVV, expiration) and checking account numbers during checkout. The incident was discovered on June 8, 2026, and notices were sent on July 27, 2026. Stack Sports engaged forensic investigators, removed the malicious code, and offered 24 months of identity theft protection.
Massachusetts clock✓ MA AG ≤30d23 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_65e50669f1507225California State AGfiled 2026-07-27(26d gap)Candidate
Source provenance
- Source URL
- https://www.mass.gov/doc/2026-1227-spay-inc-dba-stack-sports/download
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 1, 2026
- Raw hash
- 19b7304542058bbe4da61960fdb1e62b62cbee594b47dae652d9e4b3fc7d5d03
Reporting entity
- Name
- SPay Incnorm: spay
Victim entity
- Name
- SPay Incnorm: spay
Incident
- Discovered
- Jun 8, 2026
- Materiality determined
- —
- Notification sent
- Jul 27, 2026
- Affected individuals
- Not disclosed
- Data types
- FINANCIAL_ACCOUNTFINANCIAL_CREDENTIALS
- Attack vector
- Misconfiguration
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1056 Input Capture
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 23 days(23 days from discovery to filing)
- Compliance flags
- MA AG ≤30d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.