HackingRetail & ConsumerTechnologyRetailStolen CredentialsCustomer Data InvolvedDelayed DiscoveryIdentity (basic)CredentialsBehaviorLowActive

StockX

bd_94db413669707897 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 26, 2019

Filed

Aug 8, 2019

To disclose

13 days

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for StockX →

StockX, an online marketplace, experienced a data breach where an unknown third party gained unauthorized access to customer data from its cloud environment on or around May 14, 2019. The company discovered suspicious activity on July 26, 2019, and engaged forensic experts. Affected data included names, emails, addresses, usernames, hashed passwords, and purchase history. StockX implemented security updates, password resets, and credential rotations, and notified law enforcement. The company offered 12 months of free identity theft protection to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 73 days

discovery → filing · 13 days

May 14, 2019

Begins

Jul 26, 2019

Discovered

Aug 8, 2019

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_fd5190e9e9b686732019-08-09 · +1dCandidate

Name: StockX
norm: stockx

Name: StockX
norm: stockx
Industry: Retail & ConsumerllmTechnologyllm

Discovered: Jul 26, 2019
Breach occurred: May 14, 2019
Undetected for: 73 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 8, 2019
Affected individuals: Not disclosed
Data types: Identity (basic)Credentials
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1078 Valid Accounts
Threat actor: External
Regulator citations: Notified, or are notifying, appropriate regulators in the United States, the European Union, and other impacted foreign jurisdictions
Initial access: exploit_public_facing

During the incident: Engaged third-party data incident and forensic experts to assist with the investigation
Deployed a system-wide security update
Implemented a full password reset of all customer passwords
Performed high-frequency credential rotation on all servers and devices
Locked down cloud computing perimeter
Contacted law enforcement and worked with them in their investigation
Changes made: Offered 12 months of free fraud detection and identity theft protection through ID Experts (MyIDCare product)
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 days(13 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Delaware State AGAug 8 · first · this page

California State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://attorneygeneral.delaware.gov/wp-content/uploads/sites/50/2019/08/StockX-Sample-Notice.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 8, 2019
Raw hash: 8d6bd808b178d0657425ccd4174f6ae781eda741d2f81dcac8f80acfee2564cc

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityStockX

Victim entityStockX

Incidentdiscovered Jul 26, 2019

Stated responseEngaged third-party data incident and forensic experts to assist with the investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceattorneygeneral.delaware.gov