SPay Inc

SPay Inc (dba Stack Sports) notified Massachusetts residents of a cybersecurity incident involving its Sports Affinity web application. Unauthorized code was placed on the platform between May 8 and June 10, 2026, capturing payment card details (numbers, CVV, expiration) and checking account numbers during checkout. The incident was discovered on June 8, 2026, and notices were sent on July 27, 2026. Stack Sports engaged forensic investigators, removed the malicious code, and offered 24 months of identity theft protection.

SPay Inc dba Stack Sports experienced a cybersecurity incident where unauthorized code was placed on its Sports Affinity web application platform. The malicious code captured payment card information (cardholder name, card number, expiration date, CVV, and checking account numbers) entered during the checkout process. The incident window began on May 8, 2026, and was discovered on June 8, 2026. The malicious code was removed by June 10, 2026. The company engaged forensic investigators and implemented additional security measures. Affected individuals were offered 24 months of identity theft protection.

SPay Inc (dba Stack Sports) disclosed a cybersecurity incident affecting its Sports Affinity web application platform. Unauthorized code was placed on the platform between May 8 and June 10, 2026, capturing payment card information (card numbers, CVVs, checking account numbers) entered during checkout. The incident was discovered on June 8, 2026, and notices were sent on July 27, 2026. Stack Sports engaged forensic investigators, removed the malicious code, and offered 24 months of identity theft protection services to affected users.

SPay, Inc. d/b/a Stack Sports notified Washington AG of a security incident affecting 1,190 residents. Unauthorized code placed on the SportsAffinity Platform between May 8 and June 22, 2026, captured payment card details and checking account numbers via checkout pages. Incident discovered June 8, 2026. Notices sent July 27, 2026.