SPay Inc dba Stack Sports notified regulators in July 2026 of a data breach that may have exposed customers’ personal and payment information tied to its youth sports platform. The exact number of people affected has not been publicly disclosed. Anyone who used Stack Sports should monitor their financial accounts and credit reports for suspicious activity right away.
| Company | SPay Inc dba Stack Sports |
|---|---|
| Industry | Other Commercial |
| Data Types Exposed | Full Names, Contact Information, Payment or Financial Account Details, Account Login Credentials, Other Personal Identifiers |
| People Affected | Not Publicly Disclosed |
| Attack Method | Unspecified/Unauthorized Access |
| Regulators Notified | California Attorney General, Washington State Attorney General |
What Happened in the Stack Sports Data Breach?
SPay Inc, doing business as Stack Sports, recently confirmed a data security incident affecting people connected to its youth sports management platform. The company filed formal notification letters with state regulators in July 2026. As a result, affected individuals are now learning that their personal information may have been compromised.
Details about how the breach occurred have not been fully disclosed. However, the company’s notification confirms that unauthorized access to sensitive data took place. The exact discovery date has not been publicly disclosed, though the notification itself went out in July 2026.
Once Stack Sports became aware of the incident, it took steps to investigate. This likely included bringing in forensic specialists to determine the scope of the exposure. Because many of these investigations take time, the gap between discovery and public notification is common in cases like this.
In addition, companies in this position typically work to secure their systems before notifying regulators. This helps prevent further unauthorized access while the investigation continues. Stack Sports appears to have followed that same general pattern based on the timing of its filings.
Who was affected?
SPay Inc dba Stack Sports serves families, athletes, coaches, and organizations that use its platform for youth sports registration and payment processing. Given the nature of the business, affected individuals could include parents who paid registration fees, as well as coaches and league administrators who manage accounts.
The number of people affected has not been publicly disclosed. This means the true scope of the breach remains unclear at this time. Individuals who used Stack Sports’ payment or registration services should assume they could be included until more information becomes available.
Because the platform serves youth sports organizations, it is possible that minors’ information was involved. Parents who registered children for sports through Stack Sports should pay close attention to any breach notices they receive. This is especially important given how sensitive information tied to minors can be misused later in life.
The breach also has a national reach. Stack Sports works with sports organizations across the United States, so affected individuals could reside in many different states. This is reflected in the fact that the company notified attorneys general in more than one state.
What Information Was Potentially Exposed?
Based on the nature of the platform and the type of notification filed, the breach appears to involve personal and possibly financial information tied to user accounts. Stack Sports processes registration fees and other payments, which often means storing sensitive account details.
- Full names
- Contact information such as addresses, phone numbers, or emails
- Payment or financial account details
- Account login credentials
- Other personal identifiers tied to registration records
Because payment processing is central to the platform, exposed financial information could allow criminals to attempt fraudulent charges. This is a serious concern for anyone who saved a card or bank account on file. As a result, affected individuals should monitor their statements closely in the coming months.
In addition, exposed personal information can be used for identity theft. Criminals often combine stolen names, addresses, and account details to open new credit lines. This risk grows when children’s information is involved, since fraud on a minor’s identity can go unnoticed for years.
What is the company doing?
In response to the breach, Stack Sports notified state regulators, including formal filings with government agencies. The company also began notifying individuals whose information may have been affected. This process typically includes a written notice explaining what happened and what steps people can take.
Stack Sports filed notification with the California Attorney General on July 27, 2026. The company also filed with the Washington State Attorney General the following day. These filings are a required step whenever a breach affects residents of those states.
Beyond notification, companies in this situation generally review their security systems for weaknesses. This often includes tightening access controls and monitoring for further suspicious activity. While Stack Sports has not detailed every remediation step publicly, these actions are standard practice following a confirmed breach.
Affected individuals should carefully read any notice they receive from the company. This notice may include specific instructions or offers, such as credit monitoring services. Because details can vary by state, it’s worth reviewing the exact language sent to you directly.
What Should Affected Individuals Do?
Monitor Your Credit Reports
Anyone affected by this breach should start checking their credit reports regularly. This helps catch new accounts or inquiries that you did not authorize. You can request free credit reports from all three major bureaus each year.
Because fraud can take time to appear, it’s wise to check reports periodically over the coming months. If you spot anything unfamiliar, report it right away. Acting quickly can limit the damage caused by identity theft.
Consider a Fraud Alert or Credit Freeze
Since payment and account information may have been exposed, placing a fraud alert on your credit file is a smart precaution. A fraud alert requires lenders to verify your identity before opening new credit in your name. This step is free and generally lasts one year.
For stronger protection, consider a full credit freeze instead. A credit freeze blocks new creditors from accessing your file entirely, making it much harder for criminals to open accounts. You can lift the freeze temporarily whenever you need to apply for credit yourself.
Watch for Phishing Attempts
After a breach like this, scammers often send fake emails or texts pretending to be the affected company. These messages may try to trick you into revealing more personal information. Always verify the sender before clicking any links or providing details.
If you receive a suspicious message referencing this breach, avoid replying directly. Instead, contact Stack Sports through its official website or customer service line. This ensures you’re speaking with the real company rather than a scammer impersonating it.
Protect Payment Accounts
If you used a saved card or bank account on the Stack Sports platform, review those statements closely. Look for any unfamiliar charges, even small ones, since fraudsters sometimes test accounts with tiny transactions first. Report anything suspicious to your bank immediately.
In addition, consider changing your payment information tied to the platform. You may also want to update your account password, especially if you reused it elsewhere. This reduces the risk of further unauthorized access to your accounts.
Safeguard Children’s Information
Because Stack Sports serves youth sports organizations, some affected accounts may belong to minors. Parents should be especially cautious, since identity theft involving children can go undetected for years. This happens because minors rarely check their own credit reports.
To protect a child’s identity, parents can request a manual credit check through the major bureaus. If suspicious activity turns up, it’s important to act quickly to freeze the child’s file. Consulting a data breach attorney can also help families understand their options for recourse.
More Information
Official data breach notification from California Attorney General
Official data breach notification report (PDF) from Washington State Attorney General