Hack on ecommerce site StockX hits 6.8 million customers

The company initially told its customers that password resets were due to "system updates"

StockX

A cyber attack against the popular footwear trading platform StockX is thought to have exposed data belonging to 6.8 million of its customers, according to a recent report.

Customers were initially informed on Thursday that their passwords were reset due to 'system updates', only for the company to change its stance a day later, admitting that it was taking precautions against a suspected data breach.

Advertisement - Article continues below

On Friday the company alerted the press that the password reset was made out of "caution" after being "alerted to suspicious activity", following a report by TechCrunch.

The publication was approached by an anonymous data seller who claimed to have sensitive data belonging to millions of StockX's customers, and that it had been collected following a hack on the company's systems in May.

The data is said to include names, email addresses, hashed passwords and other profile information such as shoe size, preferred trading currency and type of device used to operate the account.

The anonymous source also said the stolen data was actively being sold on the dark web for $300 and there were already confirmed buyers at the time of publication.

"Though our investigation remains ongoing, forensic evidence to date suggests that an unknown third-party was able to gain access to certain customer data, including customer name, email address, shipping address, username, hashed passwords, and purchase history," a StockX spokesperson said in a statement on Saturday. "From our investigation to date, there is no evidence to suggest that customer financial or payment information has been impacted."

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"We want you to know that we took these steps proactively and immediately because we had just begun our investigation and did not yet know the nature, extent, or scope of suspicious activity to which we had been alerted," said StockX. "Though we had incomplete information, we felt a responsibility to act immediately to protect our customers while our investigation continued - and we took steps to do so."

The company, which was valued at $1 billion last month following a $110 million fundraiser, could be facing a significant GDPR fine for breach given that some of that exposed data belongs to EU residents. The penalty for GDPR violations of this kind can be up to 20 million or 4% of the company's annual global turnover, whichever is greater.

However, StockX is also facing criticism for short time it took to reverse its official stance on the password reset.

"Delays, or mixed messages, to sharing information can undermine customer confidence," said Javvad Malik, security awareness advocate at KnowBe4. "The recently levied GDPR fines show that regulators are putting an increased emphasis on customer privacy and personal information.

"Companies, like StockX, should take notice of these and look to improve their cyber security posture, not just from a compliance perspective, but from the point of view to have defensible technologies and processes in place and ensuring all staff are aware of their responsibilities," he added.

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now
Advertisement

Recommended

Visit/security/355013/10-quick-tips-to-identifying-phishing-emails
Security

10 quick tips to identifying phishing emails

16 Mar 2020
Visit/business-strategy/mergers-and-acquisitions/354941/panda-security-to-be-acquired-by-watchguard
mergers and acquisitions

Panda Security to be acquired by WatchGuard

9 Mar 2020
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/security/privacy/355155/zoom-kills-facebook-integration-after-data-transfer-backlash
privacy

Zoom kills Facebook integration after data transfer backlash

30 Mar 2020
Visit/infrastructure/server-storage/355118/hpe-warns-of-critical-bug-that-destroys-ssds-after-40000-hours
Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020
Visit/software/355113/companies-offering-free-software-to-fight-covid-19
Software

These are the companies offering free software during the coronavirus crisis

25 Mar 2020
Visit/security/cyber-crime/355171/fbi-warns-of-zoom-bombing-hackers-amidst-coronavirus-usage-spike
cyber crime

FBI warns of ‘Zoom-bombing’ hackers amid coronavirus usage spike

31 Mar 2020