Stack Sports notifies users of payment card data exposure

Cyber Insider disclosed that sports technology provider Stack Sports is notifying users of a cybersecurity incident that may have exposed payment card information entered through its Sports Affinity web application platform.

Stack Sports discovered suspicious activity on June 8, 2026, after its internal security monitoring systems detected unauthorized activity affecting the Sports Affinity platform. An investigation revealed that malicious code was placed on the platform around May 8, 2026, designed to capture payment-related information during the checkout process. The code was removed on June 10, 2026, with residual elements cleared by June 22, 2026. The incident was limited to users who accessed the Sports Affinity checkout process during the affected period.

Exposed information may have included cardholder names, payment card numbers, expiration dates, and CVV security codes. For users who paid via eCheck or ACH, checking account numbers may also have been affected. Stack Sports is offering affected users 24 months of identity theft protection services through IDX, including credit and CyberScan monitoring, a $1 million insurance reimbursement policy, and managed identity theft recovery services. The company encourages affected individuals to monitor their payment card statements for unauthorized activity.

Source: Cyber Insider