StockX Data Breach Exposes 6.8 Million User Accounts
What Happened
In July 2019 the fashion‑sneaker marketplace StockX suffered a breach that compromised 6,840,339 user records. The stolen dataset—later posted on a dark‑web marketplace—contained email addresses, names, physical addresses, usernames, purchase histories, and passwords stored as salted MD5 hashes.
Why It Matters for Compliance & Audit Readiness
- Demonstrates the need for continuous control‑assurance over credential storage — hashing algorithms must meet current NIST 800‑63B recommendations.
- Highlights the importance of documented data‑retention and disposal policies; a defensible evidence trail can prove compliance with GDPR, CCPA, and PCI‑DSS when a breach occurs.
- Reinforces that a mature monitoring program should detect anomalous data exfiltration early, providing the audit logs required for breach‑response reporting under ISO 27001 and the NIST CSF.
Who Is Affected
- Online marketplaces and consumer‑facing e‑commerce platforms
- Companies that store user‑generated purchase data and personally identifiable information (PII)
- Third‑party services integrated with such platforms (payment processors, logistics partners)
Recommended Actions
- Conduct an immediate inventory of all systems that store or transmit StockX‑type data; verify that password hashing meets modern standards (e.g., Argon2, bcrypt).
- Validate that continuous monitoring controls (SIEM, UEBA) are tuned to flag bulk data extraction and that logs are retained per regulatory requirements.
- Request a detailed incident‑response disclosure from StockX (or any downstream vendors) and update your breach‑notification procedures accordingly.
Technical Notes
- Attack vector: Likely unauthorized access to internal storage; exact method not disclosed.
- CVE(s): None reported; breach appears to stem from inadequate password‑hashing practices.
- Data types exposed: Email addresses, full names, physical mailing addresses, usernames, purchase histories, salted MD5 password hashes.
Source: https://haveibeenpwned.com/api/v3/breach/StockX