Almeida Law Group is investigating a data breach at SPay Inc dba Stack Sports. The breach occurred on May 8th, 2026. If you were affected, contact Almeida Law Group.
About SPay Inc dba Stack Sports
SPay, Inc. does business as Stack Sports and is a SaaS company that provides software solutions for sports organizations, including payment processing, registration, event management, recruiting, and league and club operations. The company serves national governing bodies, youth sports associations, leagues, clubs, coaches, and athletes, with clients that include the U.S. Soccer Federation, Little League Baseball and Softball, and Pop Warner Little Scholars. Stack Sports reports nearly 50 million users across 35 countries and is headquartered in Plano, Texas. Because the platform processes payment card transactions for sports registrations and events, it handles financial information that is attractive to payment-skimming attackers.
What Happened?
SPay Inc dba Stack Sports was listed in a California Attorney General sample breach notice filed on July 27th, 2026. According to the company’s consumer notification letter, an unauthorized actor injected malicious code—a web skimmer—into the checkout process of the Sports Affinity Platform. The skimmer was capable of capturing payment card information entered by consumers during checkout. The incident window began on or about May 8th, 2026. Stack Sports detected the suspicious activity on June 8th, 2026 through internal security monitoring, removed the malicious code from its servers by June 10th, 2026, and forcibly cleared residual code from affected customer browser caches by June 22nd, 2026. The company completed its review of impacted transactions and identified affected individuals by July 17th, 2026, with consumer notification letters dated July 27th, 2026.
The incident was limited to users of the Sports Affinity Platform who accessed the checkout process during the incident window. It did not affect other Stack Sports platforms, including Sports Connect Club, nor did it involve data stored on the platform. The company stated in its notice that it does not believe the incident constitutes a breach under certain applicable laws but chose to notify consumers proactively. Utah Youth Soccer Association independently confirmed on June 24th, 2026 that Stack Sports had reported a credit card data breach in the payment portal, and noted that account information on the Sports Connect Association Platform was not believed to be affected. No ransomware group involvement or threat actor attribution has been identified in connection with this incident.
Key Facts at a Glance
- Company or Organization: SPay Inc dba Stack Sports
- Industry: Sports Technology / SaaS Platform / Payment Processing for Sports Organizations
- Location: Plano, TX
- Incident type: Web skimmer (unauthorized code injection into checkout process)
- Date of breach: May 8th, 2026
- Date breach discovered: June 8th, 2026
- Date of consumer notification: July 27th, 2026
- Identity theft protection offered: 24 months of IDX identity theft protection with $1,000,000 insurance reimbursement policy
- Enrollment deadline: October 27th, 2026
- Prior breach: None identified
- Litigation status: No class action lawsuits or public litigation connected to this incident were found as of the research date
- Source: California Attorney General sample breach notice (https://oag.ca.gov/ecrime/databreach/reports/sb24-627175); Utah Youth Soccer Association confirmation (https://www.utahyouthsoccer.net/news/2026/06/24/sports-connect-credit-card-update/)
What Should You Do?
If you received a notification from Stack Sports, you should enroll in the 24-month IDX identity theft protection being offered before the October 27th, 2026 deadline by visiting https://response.idx.us/StackSports using the enrollment code included in your letter. Because this incident involved payment card numbers, expiration dates, CVV codes, and in some cases checking account numbers, you should contact your bank or card issuer promptly to report the potential exposure and request a new card. Consider placing a fraud alert or credit freeze with all three major credit bureaus—Equifax, Experian, and TransUnion—and monitor your accounts closely for unauthorized charges. You can obtain a free copy of your credit report at AnnualCreditReport.com. If you discover signs of fraud or identity theft, report it and get a recovery plan at IdentityTheft.gov.
Your Legal Rights
If your personal information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
