球鞋轉售平台 StockX 因洩漏個資事件將面臨集體訴訟

UPDATE：在事件爆發後的三個星期後，知名球鞋轉售平台 StockX 將要面臨相關的集體訴訟。

目的在於針對 StockX 此次失誤所造成的無法修補傷害，主要起訴人位在美國 Kansas，被稱為「I.C.」，他的法律團隊認為這起案件應該要採用集體訴訟的方式才能保證那些個資被竊取的所有年輕大小群眾。提交的文件上表示：「原告和一眾受害者在此案中受到損害，眾人將會花費更多時間與代表交談、研究和監控賬目、信用記錄、應對身份盜竊事件。由於個資洩露，需購買身份保護與遭受干擾和不便。」

目前 StockX 還未對此事發表回應。

原文：早先才剛宣布市值超過 10 億美金，知名線上球鞋轉售平台 StockX 果然就成為駭客眼中的肥羊。StockX 早先證實公司於今年五月份遭遇駭客入侵，竊取超過 680 萬份會員資料，並將其以 $300 美元的價格販售至暗網。

根據 TechCrunch 的報導指出，這次 StcokX 的網路災害遠比預期的高。流出的 680 萬會員資料包含：名稱、E-mail 帳號、非完整的密碼組合、使用者偏好的球鞋尺碼與使用的機種（Android 或 iPhone）。TechCrunch 便曾假扮買家向駭客索取更詳細的內容，駭客便將 1000 名 StockX 會員的資料免費提供給 TechCrunch 使用，TechCrunch 隨後也將名單交給 StockX 查證，經確認後的確為 StockX 的會員資料。現在這些資料經證實也早已被售出。

對於此事，StockX 發送了一則郵件表示公司正在調查中，目前還未有任何會員們的資料被盜用的案件，並提醒若是收到 StockX 要求用戶更改密碼的郵件煩請盡快更改，以免有心者盜用，使得會員權益受損。

信件內容如下：

Dear Customer,
StockX cares deeply about the privacy of our customers. In recent days, our company has discovered a data security issue, and we want to provide you with an update on this situation.
We were alerted to suspicious activity potentially involving customer data. Upon learning of the suspicious activity, we immediately launched a comprehensive forensic investigation and engaged third-party data incident and forensic experts to assist. Though our investigation remains ongoing, forensic evidence to date suggests that an unknown third-party was able to gain access to certain customer data, including customer name, email address, shipping address, username, hashed passwords, and purchase history. From our investigation to date, there is no evidence to suggest that customer financial or payment information has been impacted.
While conducting our forensic investigation into the suspicious activity, and out of an abundance of caution, we implemented immediate infrastructure changes to mitigate and address any potential effects of the suspicious activity. These infrastructure changes included:
-a system-wide security update;
-a full password reset of all customer passwords with an email to customers alerting them about resetting their passwords;
-high-frequency credential rotation on all servers and devices; and
-a lockdown of our cloud computing perimeter
We want you to know that we took these steps proactively and immediately, because we had just begun our investigation and did not yet know the nature, extent, or scope of suspicious activity to which we had been alerted. Though we had incomplete information, we felt a responsibility to act immediately to protect our customers while our investigation continued—and we took steps to do so.
As we investigate, StockX will continue to take additional measures, as needed, to protect the privacy of our customers. In the meantime, out of an abundance of caution, we recommend that if you use your StockX password for other accounts, you change those passwords as well.
Again, we take data security and privacy very seriously, and will continue to communicate with our customers and work hard to protect those who trust us with their shopping experience.

除此之外，亦可留意 COMME des GARÇONS x Air Jordan 1 聯乘鞋款正式販售。