Breach Disclosure: StockX

StockX, a Detroit based e-commerce company founded in 2015, has disclosed a data breach that affected 6.8 million accounts. The breach consists of names, emails, physical addresses, purchase history and MD5 encrypted passwords. StockX published about the breach in their news section on August 8, 2019.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Remain alert to potential spear phishing attacks through email and social media

Details

StockX was initially alerted to suspicious activity involving their customer data on July 26, 2019. They immediately started an investigation on the possible sources of the breach and concluded that an unknown third party gained access to their customer data. According to the disclosure, no credit card or payment information was compromised.

StockX is contacting their affected customers, making changes in their inner infrastructure and is offering 12 months of MyIDCare fraud detection and identity theft protection for victims.