ServerTest

StockX, a popular site for buying and selling sneakers and other apparel, has admitted it reset customer passwords after it was “alerted to suspicious activity” on its site, despite telling users it was a result of “system updates.”

“We recently completed system updates on the StockX platform,” said the email to customers sent to TechCrunch on Thursday. The email provided a link to a password reset page but said nothing more.

The company was only last month valued at over $1 billion after a $110 million fundraise.

Companies reset passwords all the time for various reasons. Some security teams obtain lists of previously breached passwords that make their way online, scramble them in the same format that the company stores passwords, and find matches. By triggering the reset, it prevents passwords stolen from other sites from being used against one of a company’s own customers. In less than desirable circumstances, passwords are reset following a data breach.

But the company admitted it was not “system updates” as it had told its customers.

“StockX was recently alerted to suspicious activity potentially involving our platform,” said StockX spokesperson Katy Cockrel. “Out of an abundance of caution, we implemented a security update and proactively asked our community to update their account passwords.”

“We are continuing to investigate,” said the spokesperson.

We asked several follow-up questions — including who alerted StockX to the suspicious activity, if any customer data was compromised and why it misrepresented the reason for the password reset. We’ll have more when we know it.

Throughout the day customers were tweeting screenshots of the email, worried that their accounts had been compromised. Others questioned whether the email was genuine or if it was part of a phishing attack.

“Did they get hacked, find out somehow, and then to cover it up send out that email and ask for a password change?,” one of the affected customers told TechCrunch.

Customers were given no prior warning of the password reset.

StockX founder Josh Luber kept with the company’s line, telling a customer in a tweet that the password reset was “legit” but did not respond to users asking why.

StockX tweeted back to several customers with a boilerplate response: “The password reset email you received is legitimate and came from our team,” and to contact the support email with any questions. We did just that — from our TechCrunch email address — and heard nothing back hours later.

Security experts expressed doubt that a company would reset passwords over a “systems update” as StockX had claimed.

Security researcher John Wethington said it is “rare” to see security overhauls that require password resets. “You wouldn’t just send out a random email about it,” he said. Jake Williams, founder of Rendition Infosec, said it was “bad communication” in any case.

Several took to Twitter to criticize StockX for its handling of the password reset.

One customer called the email “fishy,” another called it “suspicious” and another called on the company to explain why they had to reset passwords in this unorthodox way. Another said in a tweet that he asked StockX twice but they “refused to provide an answer.”

“Guess I’m closing my account,” he said.

Read more:
Slack resets user passwords after 2015 data breach
Capital One breach also hit other major companies, say researchers
An exposed password let a hacker access internal Comodo files
Security lapse exposed weak points on Honda’s internal network
Cryptocurrency loan site YouHodler exposed unencrypted user credit cards and transactions

Direct-to-consumer plant retailer Bloomscape has raised $7.5 million in Series A funding, with several high-profile D2C startup founders signing on as investors.

Founder and CEO Justin Mast told me that his family has five generations of experience as greenhouse owners and operators, and that he first tried to get Bloomscape off the ground more than a decade ago. Since then, Mast has worked at other startups, but he said, “Bloomscape was the one that got away. I would find myself dreaming about it.”

The current version of the startup launched just over a year ago, and has shipped more than 100,000 plants since then. The company is headquartered in Detroit, and ships plants from its greenhouses near Grand Rapids, Mich.

When asked what’s wrong with the existing brick-and-mortar plant-buying process, Mast said convenience is a big factor, particularly once you start talking about plants that are too big to carry in one hand — he said Bloomscape’s packing and shipping methods can accommodate everything from a 10-inch aloe plant to a five-foot bird of paradise.

Bloomscape also helps people care for their plants through its Plant Mom service, allowing customers to ask for advice from an expert. The Plant Mom is, in fact, Mast’s mother Joyce, who has more than 40 years of horticulture experience.

Mast said the service is designed to replicate his own experience texting his Mom for help when his plants weren’t doing well: “We wanted to figure out how to do this in a way that didn’t feel like tech support, that actually felt convenient, warm and helpful.” (Bloomscape has since hired other experts to support her.)

Mast added that he sees the free service as “this tremendous opportunity to create value,” particularly since “people who feel confident that they’re going to be able to keep their plants alive go and buy more plants.”

Ultimately, Mast’s vision is for Bloomscape to be involved in “plant life in every area of the home and garden.”

The new round was led by Revolution Ventures, with participation from Endeavor, as well as Allbirds co-founder Joey Zwillinger, Away co-founder Jen Rubio, Eventbrite co-founder Kevin Hartz, Harry’s co-founder Jeff Raider, Quora co-founder Charlie Cheever and Warby Parker co-founders Neil Blumenthal and Dave Gilboa.

“Plants are a highly fragmented, fast growing industry, but the market has been slow to come online – warehousing and shipping living things is hard,” Revolution Ventures partner Clara Sieg said in a statement. “Drawing on five generations of horticultural experience, Justin and the Bloomscape team combines the ease of e-commerce with care and maintenance resources in a beautifully branded, consumer-centric experience that empowers even the least green thumbed among us to be successful plant parents.”