SPay Inc
bd_65e50669f1507225 · schema v1 · pii pii-v1
Full breach record for SPay Inc →SPay Inc dba Stack Sports experienced a cybersecurity incident where unauthorized code was placed on its Sports Affinity web application platform. The malicious code captured payment card information (cardholder name, card number, expiration date, CVV, and checking account numbers) entered during the checkout process. The incident window began on May 8, 2026, and was discovered on June 8, 2026. The malicious code was removed by June 10, 2026. The company engaged forensic investigators and implemented additional security measures. Affected individuals were offered 24 months of identity theft protection.
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_443fdcd624ea3269Massachusetts State AGfiled 2026-07-01(26d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-627175
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Jul 27, 2026
- Raw hash
- 56d0aaa0e96c732b2119b66c49bd52d1523e6bd99526f11fda78ff8811e5d76c
Reporting entity
- Name
- SPay Incnorm: spay
Victim entity
- Name
- SPay Incnorm: spay
Incident
- Discovered
- Jun 8, 2026
- Materiality determined
- —
- Notification sent
- Jul 27, 2026
- Affected individuals
- Not disclosed
- Data types
- FINANCIAL_ACCOUNTFINANCIAL_CREDENTIALSIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing ApplicationT1056 Input Capture
- Threat actor
- ExternalFinancial
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 7 weeks(49 days from discovery to filing)
- Compliance flags
- CA 30-day late · 49dCA AG copy ≤15d · 0d
- Discovery-date grounding
- letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jun 8, 2026→ Notified: Jul 27, 202649d 30 calendar days CA 30-day late California Consumers notified: Jul 27, 2026→ AG copy submitted: Jul 27, 20260d 15 calendar days CA AG copy ≤15d
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.