StockX Data Breach (2019): What Was Exposed & What To Do

Known details remain limited to the scale and contents reported at the time. The incident affected 6.8 million records and involved data later offered for sale through an underground marketplace. The passwords were stored as salted MD5 hashes. No further technical findings or attacker attribution have been made public.

What happened

On 26 July 2019 the sneaker and fashion trading platform StockX confirmed a data breach. The exposed records, numbering 6.8 million, were subsequently listed for sale on a dark-web marketplace. The data set was later supplied to Have I Been Pwned by dehashed.com. No official statement has detailed the intrusion method, timeline of access, or whether the incident involved a single event or ongoing exposure.

How a breach like this happens

Incidents involving marketplaces often begin with the compromise of a web application, server, or third-party service that stores customer data. Attackers may exploit unpatched software, weak authentication controls, or stolen credentials to reach databases. Once inside, they copy files containing account and transaction information. The material is then packaged and offered for sale on closed forums, where buyers seek email lists, hashed passwords, and purchase histories for further criminal use.

Who is StockX?

StockX operates an online marketplace that connects buyers and sellers of sneakers, streetwear, and other fashion items. Like similar platforms, it collects account credentials, shipping addresses, and records of completed transactions. A breach at such a service is consequential because the data can link online identities to real-world addresses and spending patterns, information that retains value for targeted follow-on activity.

What data was at risk

The reported data set contained email addresses, names, usernames, physical addresses, purchase histories, and passwords stored as salted MD5 hashes. No additional categories have been confirmed by the company or independent investigators.

What's at stake

For individuals, the exposure of addresses and purchase records can support phishing campaigns or account takeover attempts, especially when passwords are reused elsewhere. Hashed passwords require additional effort to misuse, yet salted MD5 remains a legacy format that can be attacked offline if the hashes are obtained. For the organisation, the incident created reputational and regulatory exposure typical of any large consumer-data loss, though the precise business impact has not been quantified publicly.

Were you affected?

Users can check whether their email address appears in known breach data sets through free lookup services. Practical next steps include:

• Changing the StockX password and any other account that used the same credentials.
• Enabling multi-factor authentication wherever available.
• Monitoring financial accounts and delivery addresses for unexpected activity.
• Reviewing privacy settings on other marketplaces that store similar information.

Running a free exposure scan of an email address remains the quickest way to determine whether the address has surfaced in publicly reported breach collections.

AICompiled with AI assistance from public sources and published under our editorial standards.