UPDATE – 08/08/2019
We wanted to follow up on the email customers received from us on August 3, 2019 and to provide additional information about the data security incident we recently discovered.
First, let us say how much we regret that customers are dealing with this issue at all. We take the trust you place in us very seriously, and this is not the kind of experience we want for our community.
While we have worked to do everything we could to best protect our customers, when we first communicated we did not have much information, which unfortunately is a frustrating reality of data incidents. We hope our August 8th Customer Notification letter will provide better clarity into the timeline and our actions, but regardless, we do want to deeply apologize for any confusion.
We hope this will provide you with additional facts about the incident, steps we took in response to protect you, and measures we are taking to remediate any potential effects of the suspicious activity to which we have been alerted.
Please know how important you and all our customers are to this community, and that your privacy and security are a top priority for us.
Below you will find an FAQ on the matter. The original August 3rd communication to customers can be found below, and the August 8th letter to customers can be found here.
What happened?
On July 26, 2019, we were alerted to suspicious activity potentially involving our customer data. We immediately launched a forensic investigation and engaged experienced third-party data experts to assist. Though our investigation remains ongoing, forensic evidence to date suggests that an unknown third-party was able to gain access to certain customer data, including customer name, email address, address, username, hashed passwords, and purchase history. From our investigation to date, there is no evidence to suggest that customer financial or payment information has been impacted.
What personal information was involved?
Though our investigation remains ongoing, forensic evidence to date suggests that an unknown third-party was able to gain unauthorized access to certain customer data, including customer name, email address, address, username, hashed passwords, and purchase history. From our investigation to date, there is no evidence to suggest that customer financial or payment information has been impacted.
What did StockX do in response?
Upon first learning of the suspicious activity, we immediately launched an internal forensic investigation into the reported activity. On the same day, we engaged third-party data incident and forensic experts to assist with the investigation. While we were conducting our forensic investigation into the suspicious activity, we took proactive steps to implement infrastructure changes to mitigate and address any potential effects of the suspicious activity, including deploying a system-wide upgrade and full password reset. We have also contacted law enforcement and have been working with them in their efforts to catch the perpetrator. Once our investigation revealed evidence to suggest customer data may have been accessed by an unknown third party, we sent customers an email on August 3, 2019 to make them aware of the incident, and thereafter sent a more detailed notification to our customers with further information regarding the incident. As our investigation continues, we will continue to communicate with our customers about the incident as necessary.
What is StockX doing for me?
While we were conducting our forensic investigation into the suspicious activity, we initially took some proactive and immediate steps to implement infrastructure changes to mitigate and address any potential effects of the suspicious activity. These infrastructure changes included: a system-wide update to upgrade the encryption of customer passwords; a full password reset of all customer passwords with an email to customers alerting them about resetting their passwords; high-frequency credential rotation on all servers and devices; and a lockdown of our cloud computing perimeter.
Additionally, out of an abundance of caution, we have arranged for you to have 12 months of free fraud detection and identity theft protection through ID Experts® to provide you with MyIDCare™. MyIDCare services include: CyberScan monitoring, fully managed id theft recovery services, a $1,000,000 insurance reimbursement policy, and 12 months of free credit monitoring. With this protection, MyIDCare will help you resolve issues if your identity is compromised.
What else can I do to protect myself?
We encourage you to regularly review and monitor your credit and debit card statements and credit reports, and report any suspicious or unrecognized activity immediately. Rather than waiting to receive monthly statements you may want to review them online. You can also ask the issuing bank what options for additional account security they may offer. Although the passwords impacted by the incident were hashed, if you used that StockX password for any other accounts, we would recommend that you change the password for those accounts as well.
What if I have additional questions about this incident?
We encourage you to contact ID Experts with any questions and to enroll in the free MyIDCare services by calling (833) 300-6935 (if you are calling from the United States) or +1-971-317-8411 (if you are calling from outside of the United States) or by going to https://ide.myidcare.com/stockx. Please note the deadline to enroll is November 8, 2019.
——————–
Original post as of 08/03/2019
StockX cares deeply about the privacy of our customers. In recent days, our company has discovered a data security issue, and we want to provide you with an update on this situation.
We were alerted to suspicious activity potentially involving customer data. Upon learning of the suspicious activity, we immediately launched a comprehensive forensic investigation and engaged third-party data incident and forensic experts to assist. Though our investigation remains ongoing, forensic evidence to date suggests that an unknown third-party was able to gain access to certain customer data, including customer name, email address, shipping address, username, hashed passwords, and purchase history. From our investigation to date, there is no evidence to suggest that customer financial or payment information has been impacted.
While conducting our forensic investigation into the suspicious activity, and out of an abundance of caution, we implemented immediate infrastructure changes to mitigate and address any potential effects of the suspicious activity. These infrastructure changes included:
- a system-wide security update;
- a full password reset of all customer passwords with an email to customers alerting them about resetting their passwords;
- high-frequency credential rotation on all servers and devices; and
- a lockdown of our cloud computing perimeter
We want you to know that we took these steps proactively and immediately, because we had just begun our investigation and did not yet know the nature, extent, or scope of suspicious activity to which we had been alerted. Though we had incomplete information, we felt a responsibility to act immediately to protect our customers while our investigation continued—and we took steps to do so.
As we investigate, StockX will continue to take additional measures, as needed, to protect the privacy of our customers. In the meantime, out of an abundance of caution, we recommend that if you use your StockX password for other accounts, you change those passwords as well.
