HackingRetail & ConsumerRetailCustomer Data InvolvedDelayed DiscoveryIdentity (basic)CredentialsBehaviorLowActive

StockX

bd_fd5190e9e9b68673 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 26, 2019

Filed

Aug 9, 2019

To disclose

14 days

Affected

Not disclosed

Linked

2 filings

Confidence

63%

Full breach record for StockX →

StockX LLC notified customers of unauthorized access to its cloud environment occurring on or around May 14, 2019, discovered on July 26, 2019. Affected data includes names, email addresses, physical addresses, usernames, hashed passwords, and purchase history. Financial data was not stored by StockX and was not affected. The company engaged third-party forensic experts, reset all passwords, rotated credentials, and locked down its cloud perimeter. Law enforcement was contacted. The investigation remains ongoing.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jul 26, 2019 → Notified Aug 8, 201913d ✓ CA 60-day OK14 days discovery → filing

Incident timeline

undetected · 73 days

discovery → filing · 14 days

May 14, 2019

Begins

Jul 26, 2019

Discovered

Aug 9, 2019

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Delaware State AGbd_94db4136697078972019-08-08 · +1dVerified

Name: StockX
norm: stockx

Name: StockX
norm: stockx
Industry: Retail & Consumerllm

Discovered: Jul 26, 2019
Breach occurred: May 14, 2019
Undetected for: 73 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 8, 2019
Affected individuals: Not disclosed
Data types: Identity (basic)CredentialsBehavior
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: Notified, or are notifying, appropriate regulators in the United States, the European Union, and other impacted foreign jurisdictions

During the incident: Launched a forensic investigation and engaged experienced third-party experts to assist
Deployed a system-wide security update
Implemented a full password reset of all customer passwords for all StockX accounts
Sent customers an email alerting them to the systems update and password reset
Implemented high-frequency credential rotation on all servers and devices
Lockdown of our cloud computing perimeter
Contacted law enforcement and have been working with them in their investigation
Notified, or are notifying, appropriate regulators of the incident
Offering 12 months of free fraud detection and identity theft protection through ID Experts
Changes made: Deployed a system-wide security update
Implemented high-frequency credential rotation on all servers and devices
Lockdown of our cloud computing perimeter
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: CA 60-day OK · 13d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jul 26, 2019
→ Notified: Aug 8, 2019
13d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jul 26, 2019 → Notified: Aug 8, 2019	13d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Delaware State AGAug 8 · first

California State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-149617
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 9, 2019
Raw hash: e1ab97b7dcd2981479393631965a96e2c89d63981210e132a952017d5cbb8a9d

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityStockX

Victim entityStockX

Incidentdiscovered Jul 26, 2019

Stated responseLaunched a forensic investigation and engaged experienced third-party experts to assist

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov