Class Action Claims StockX Failed to Prevent, Attempted to Cover Up Data Breach [UPDATE]
Last Updated on September 3, 2021
I.C. v. StockX, Inc. et al.
Filed: August 19, 2019 ◆§ 2:19-cv-12441-VAR-EAS
A class action suit accuses StockX of failing to safeguard customers' personally identifiable information and attempting to cover up a recent data breach.
Case Updates
September 3, 2021 – Related Suit Excluded from Arbitration
A lawsuit filed on behalf of California consumers whose data was compromised in the StockX data breach has been excluded from arbitration, according to an order issued in June 2021.
While the case detailed on this page, along with several other related suits, was sent to arbitration in December 2020 in a decision later appealed by the plaintiffs, another related case filed by a California consumer was excluded from those proceedings.
U.S. District Judge Victoria A. Roberts found that the claims in the California woman’s case are governed by California law and that StockX’s choice of law clause, i.e., a clause in the company’s terms of use mandating that disputes be governed by Michigan law, is unenforceable for California consumers.
According to court documents, the lawsuit looks to represent “all citizens of California whose Customer Data was stolen from StockX during the Data Breach.”
A class action lawsuit brought against StockX, Inc. on behalf of an unnamed minor alleges the online retailer negligently failed to safeguard customers’ personally identifiable information (PII) and then fraudulently attempted to conceal a data breach affecting more than 6.8 million users.
StockX is an online e-commerce platform that specializes in fashionable clothing with a particular emphasis on high-end sneakers. The platform functions in a similar way to the stock market with each product being assigned a ticker symbol. Sellers will then offer up their asking prices and buyers will bid on items, the lawsuit says. StockX requires all users to register for an account, for which they must provide their name and email address and come up with a username and password, according to the case.
On August 1, 2019, StockX sent out an email in which it prompted users to update their usernames and passwords due to “recently completed system updates,” the lawsuit says. The case claims, however, that this email was actually sent to mitigate the damage from a recent hack of StockX during which an unauthorized third party gained access to the defendant’s system. Several days after the breach, the hacker who stole proposed class members’ information listed the account details of approximately 6.8 million users for sale on the dark web, the complaint states.
The technology website TechCrunch reported the breach on August 3 after an “unnamed data breached [sic] seller” contacted the publication and provided a sample of StockX user data being sold on the dark web. TechCrunch says it verified this information by contacting the customers to whom the stolen information belonged. After the TechCrunch article was published, StockX sent out a second email in which confirmed that the breach had occurred and was the impetus behind their previous email requiring users to update their account information, the suit says.
According to the suit, the stolen information is already being used fraudulently. The case includes an account of one alleged instance in which a pair of Jordan 1 sneakers was bought for $23,000 using stolen account information.
“The PII that plaintiff and the class entrusted to StockX has been stolen, sold and purchased by criminals who will seek and have already sought to misuse it,” the case states.
More concerning than the breach itself is the number of minors affected by the hack. According to the suit, StockX is very popular with teenagers, and teen boys in particular are responsible for a large share of the platform’s revenue. Co-founder Dan Gilbert even credits his son and his teenage friends’ interest in buying sneakers as a major reason he helped found StockX. The suit contends that due to their age, the class of minors it seeks to represent are not bound by StockX’s class-waiver and forced-arbitration clauses and are therefore eligible to sue.
The suit claims that StockX was negligent in its failure to protect customer information and fraudulently misrepresented that its password updates were necessary due to a system update. The case contends that StockX failed to use industry-standard measures to secure customer information and has failed to specify what data it collects and stores in its privacy policy.
Several other lawsuits have been filed against StockX over the data breach, including one filed in Florida back in May.
The suit seeks to cover all minors in the United States who provided StockX with PII and whose information was exposed in the alleged breach.
Before commenting, please review our comment policy.