HackingStolen CredentialsData ExfiltratedCustomer Data InvolvedIDENTITY_BASICCREDENTIALSLowActive
StockX
bd_fd5190e9e9b68673 · schema v1 · pii pii-v1
Full breach record for StockX →StockX LLC reported a data breach affecting customer data including names, email addresses, addresses, usernames, hashed passwords, and purchase history. The unauthorized access occurred on or around May 14, 2019, and was detected on July 26, 2019. StockX engaged forensic experts, reset passwords, and offered 12 months of identity theft protection. No financial or payment card data was affected.
California clockDiscovered Jul 26, 2019 → Notified Aug 8, 201913d ✓ CA 60-day OK14 days discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
This filing is one of 2 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_94db413669707897Delaware State AGfiled 2019-08-08(1d gap)Verified
Source provenance
- Source URL
- https://oag.ca.gov/ecrime/databreach/reports/sb24-149617
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Aug 9, 2019
- Raw hash
- e1ab97b7dcd2981479393631965a96e2c89d63981210e132a952017d5cbb8a9d
Reporting entity
- Name
- StockXnorm: stockx
Victim entity
- Name
- StockXnorm: stockx
Incident
- Discovered
- Jul 26, 2019
- Materiality determined
- —
- Notification sent
- Aug 8, 2019
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICCREDENTIALS
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Regulator citations
- Notified appropriate regulators in the United States, the European Union, and other impacted foreign jurisdictions
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 14 days(14 days from discovery to filing)
- Compliance flags
- CA 60-day OK · 13d
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status California Discovered: Jul 26, 2019→ Notified: Aug 8, 201913d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.