The Stockx data breach has seen the company come under fire for attempting to cover up the incident.

Stockx is a major online marketplace that fell victim to a data breach in May 2019, which saw the data of millions of users stolen.

The attack apparently stole sensitive information of 6.8 million users worldwide.

Tech Crunch recently connected a suspicious “security update” rollout initiated by Stockx to a serious Stockx data breach. According to a source, 6.8 million users had their sensitive data stolen and subsequently sold on the dark web for US$300 (approx. S$415). After obtaining 1,000 sample records from the unknown seller, Tech Crunch contacted the Stockx users to cross-check sensitive information which included shoe size, email addresses and device type, among others. All respondents confirmed the data as accurate.

We understand many of you have questions regarding our recent data security issue. You can find details on the matter in our blog post. Our investigation is ongoing, and we will be updating the blog when we have additional information to provide. https://t.co/0aUhmCZ7Uv

— StockX (@stockx) August 4, 2019

The revelation caused an uproar on social media, which prompted the company to come clean following attempts at covering up the attack. Read the full statement from Stockx below:

“StockX cares deeply about the privacy of our customers. In recent days, our company has discovered a data security issue, and we want to provide you with an update on this situation.

We were alerted to suspicious activity potentially involving customer data. Upon learning of the suspicious activity, we immediately launched a comprehensive forensic investigation and engaged third-party data incident and forensic experts to assist. Though our investigation remains ongoing, forensic evidence to date suggests that an unknown third-party was able to gain access to certain customer data, including customer name, email address, shipping address, username, hashed passwords, and purchase history. From our investigation to date, there is no evidence to suggest that customer financial or payment information has been impacted.

While conducting our forensic investigation into the suspicious activity, and out of an abundance of caution, we implemented immediate infrastructure changes to mitigate and address any potential effects of the suspicious activity. These infrastructure changes included:

1. a system-wide security update;
2. a full password reset of all customer passwords with an email to customers alerting them about resetting their passwords;
3. high-frequency credential rotation on all servers and devices; and
4. a lockdown of our cloud computing perimeter

We want you to know that we took these steps proactively and immediately, because we had just begun our investigation and did not yet know the nature, extent, or scope of suspicious activity to which we had been alerted. Though we had incomplete information, we felt a responsibility to act immediately to protect our customers while our investigation continued—and we took steps to do so.

As we investigate, StockX will continue to take additional measures, as needed, to protect the privacy of our customers. In the meantime, out of an abundance of caution, we recommend that if you use your StockX password for other accounts, you change those passwords as well.

Again, we take data security and privacy very seriously, and will continue to communicate with our customers and work hard to protect those who trust us with their shopping experience.”

The fashion and sneaker trading platform will likely remain a popular marketplace, but this should send a clear signal to tech companies about the need for greater transparency, especially in cases of sensitive data breaches. Users deserve to know about such incidents as soon as possible to avoid further issues such as the illegal use of their data for fraudulent transactions.

What’s your take on this? Would you still continue using Stockx? Share your thoughts with us below.

Featured image: Wall Street Journal

Read more: Apple highlights inclusiveness with new emoji update coming this fall