StockX stockx.com StockX data breach: what happened and what to do
In July 2019, sneaker marketplace StockX was breached and the data was later sold on a dark web marketplace. Have I Been Pwned counts 6.8 million email addresses, along with names, shipping addresses, usernames, purchases and passwords stored as salted MD5 hashes.
View all 13,115 breaches- Breach date
- 26 Jul 2019
- Affected
- 6,840,339
- Data exposed
- Email addresses, Names, Passwords, Physical addresses, Purchases, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
StockX, the sneaker and streetwear trading platform, was alerted to suspicious activity on its systems in July 2019. Have I Been Pwned dates the breach to July 26, 2019. The data was then offered for sale on a dark web marketplace and later added to Have I Been Pwned in August 2019.
StockX first emailed customers a request to reset their password and described it as part of a system update. After the breach became public, the company confirmed what had happened. It said it had brought in outside forensic experts, upgraded its systems and reset every customer's password. It also offered affected customers free fraud and identity theft protection for a year.
What was exposed
Have I Been Pwned counts 6,840,339 unique email addresses. The records also contained names, physical addresses, usernames, purchase history and passwords stored as salted MD5 hashes. MD5 is a fast, older method, so weaker passwords can be cracked.
What it means for you
A shipping address combined with a name and what you bought is enough for a believable phishing message about an order. Someone could also use it to guess what you own and what it's worth. The passwords were reset by StockX, but if you used the same one on another site, that site is still at risk.
If you had a StockX account in 2019, the practical steps are to make sure your password there is unique and to treat order and shipping emails with care.
What to do if you were in it
- 1
Change the password and anywhere you reused it
Set a new password on the affected account. Then change it on any other site where you used the same one, starting with email and banking. A password manager makes unique passwords painless.
- 2
Turn on two-factor login
Use an authenticator app or a security key on your email, bank and shopping accounts. A stolen password alone then isn't enough to get in.
- 3
Expect phishing that mentions the breach
Criminals use your name, address and purchase history to write messages that look personal. Don't click links in unexpected emails or texts about your account. Go to the site directly instead.
- 4
Check whether your email or phone is in this and other breaches
Run a free scan with Serus to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you if your data shows up again.
Frequently asked
Was I affected by the StockX data breach?
If you had a StockX account in 2019, possibly. Search your email address on Have I Been Pwned to see whether it appears.
What was exposed?
Email addresses, names, shipping addresses, usernames, purchase history and salted MD5 password hashes.
Did StockX reset my password?
StockX said it reset every customer's password after the breach. Reset it anyway on other sites where you used the same one.
Did StockX offer anything to affected customers?
Reports say StockX offered 12 months of free fraud and identity theft protection.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
