Stack Sports checkout skimmer exposed payment data

Analyst assessment

DysruptionHub assesses with high confidence that Stack Sports experienced a web-skimming incident on its Sports Affinity checkout process. In a July 27 consumer notice, Stack Sports said an unauthorized person placed code on the platform that captured payment-related information entered during checkout. The company dated the unauthorized activity to about May 8, detected it through internal monitoring June 8, removed the malicious code from its servers by June 10 and forcibly cleared residual elements from an isolated number of customer browser caches June 22.

The notice narrowed the affected environment to Sports Affinity users who accessed checkout during the incident window. Stack Sports said the incident did not affect other Sports Affinity users, Sports Connect Club or other Stack Sports platforms, and did not involve data stored on Sports Affinity beyond encrypted transaction tokens.

Operational significance

Utah Youth Soccer’s earlier June 24 update documented the incident’s operational effect: the association disabled registration and payments after families reported unauthorized card charges, then restored those functions after Stack Sports said the source had been neutralized. FOX 13 reported that families could not register and that multiple parents replaced cards after suspicious charges.

The later notice shows the data impact extended beyond the initially documented Utah customer. The California Department of Justice’s breach record identifies a May 8 breach date and July 27 report date; the department publishes these samples when more than 500 California residents received notice. Stack Sports did not disclose an exact total or a complete geographic distribution.

Potentially affected fields were cardholder name, payment-card number, expiration date and CVV, plus checking-account number for some eCheck or ACH users. Stack Sports said account credentials, profile information, uploaded documents, Social Security numbers and driver’s license numbers were not involved.

Disclosure posture

Utah Youth Soccer issued the first public warning June 19 after member fraud reports, while Stack Sports was still investigating. The association relayed Stack Sports’ breach confirmation and restoration statement June 24. Stack Sports later finalized its review of impacted transactions and mailing addresses July 17 and issued consumer notices dated July 27, offering 24 months of identity-protection services.

The consumer notice says Stack Sports did not believe the incident constituted a breach under certain applicable laws but notified affected people so they could protect their information. That legal qualification does not negate the company’s factual findings about unauthorized checkout code and potentially affected payment data.

Current status

The operational disruption is resolved. Stack Sports reported clearing residual capture-code elements by June 22, and Utah Youth Soccer said June 24 that registration and payments could safely resume. The later affected-transaction review and notifications are breach-response milestones, not evidence that operational disruption continued.

Confidence and uncertainty

Confidence is high that malicious code captured payment data because Stack Sports directly described the code, the incident window and its removal. The evidence supports unauthorized access and malware as broad mechanisms, but it does not establish how the actor placed the code or first entered the environment.

Confidence is high that payment information was affected, although the notice uses potentially affected language for individual data fields. Parent reports of fraudulent charges provide corroborating misuse evidence, but the public record does not quantify confirmed fraudulent transactions. No evidence supports ransomware, extortion or a named threat actor.

Analytic gaps

The reviewed sources do not identify the initial access vector, exploited vulnerability, compromised credential, malicious-code family, actor infrastructure, responsible person or dwell time before May 8. They also do not disclose the total affected-person, transaction or card count; every affected customer organization or jurisdiction; or the amount of confirmed fraud.

No public forensic report explains how the unauthorized code was placed, whether captured data was transmitted directly to actor-controlled infrastructure or whether additional monitoring identified attempted recurrence.