Stack Sports Data Breach
The 2026 Stack Sports data breach is a confirmed incident in which unauthorized code placed on Sports Affinity checkout pages captured card or bank-account information entered by some users. Stack Sports has not publicly disclosed the total number of people affected.
The organization has not published how many were affected, so the incident cannot be placed on this scale.
Exposed Data Types
3- Names
- Credit card numbers
- Bank account numbers
About This Breach
Stack Sports is a sports-technology platform operated by SPay, Inc. that provides registration, payment, and management software to sports organizations. The incident was limited to people who used the Sports Affinity checkout process during the relevant period; the notice does not say that other Stack Sports platforms were affected.
How Did the Incident Occur?
According to the company notice, unauthorized code was placed in the Sports Affinity checkout flow starting on or about May 8, 2026 and captured certain information entered during payment. Stack Sports detected suspicious activity on June 8, removed the code from its servers by June 10, and cleared residual elements from a limited number of browser caches on June 22. Its review of affected transactions was completed on July 17.
What Information Was Affected?
The potentially affected fields depend on the payment method. The disclosed scope includes cardholder names, payment-card numbers, expiration dates, security codes, and checking-account numbers for people who paid by eCheck or ACH. Stack Sports says account credentials, profile information, uploaded documents, Social Security numbers, and driver's license numbers were not involved.
How Did Stack Sports Respond?
Stack Sports says it removed the unauthorized code, secured the platform, and worked with an independent incident-response team on a forensic investigation. It implemented additional security and monitoring measures, sent notices to identified individuals on July 27, and offered complimentary identity-protection services.
What Should Affected People Do?
Notice recipients should regularly review the card and bank accounts used during the incident period for unfamiliar transactions. If a suspicious payment appears, the card issuer or financial institution should be contacted promptly, and card or account details can be replaced when appropriate. Unexpected payment or verification messages claiming to be from Stack Sports should be confirmed through the company's official channels before opening links.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
