Headed for a closing, Sports Authority auctioned off its intellectual property, including about 114 million customer files and 25 million email addresses, to Dick’s Sporting Goods.

Share story

When Sports Authority said “everything must go,” it meant everything — including its customers’ personal information.

The Colorado-based sporting-goods retailer, which filed for Chapter 11 bankruptcy protection in March, auctioned its intellectual property last week, including the Sports Authority name, its e-commerce site, about 114 million customers’ files and 25 million email addresses. Dick’s Sporting Goods won with a $15 million bid.

The customer data could help Dick’s land Sports Authority customers looking for a new place to shop. “It’s extremely valuable data for companies to identify customers who are looking for a new home,” said Hemu Nigam, chief executive officer of SSP Blue and a cybersecurity expert.

As more companies come to understand the value of data, customer information has been auctioned in bankruptcy cases. Yet as consumers work to safeguard their data after breaches at companies, such as those at Target and health-insurer Anthem, these types of sales are another way customers can lose control of their personal information.

“Customer emails are stolen every day (but) they lack awareness that this is a possibility,” Nigam said. “The auction is raising awareness of another way customer data can be sold without even thinking about it.”

Businesses can legally sell consumer information as long as their privacy policies make it clear that data can be transferred or sold if the company is acquired or goes out of business.

Sports Authority posted its policy on its website: “We may transfer your personal information in the event of a corporate sale, merger, acquisition, dissolution or similar event.”

When a buyer obtains customer information through an acquisition or merger, it often allows new customers to follow the same privacy policy they had with the previous firm. But it’s not guaranteed.

As it underwent bankruptcy proceedings last year, RadioShack tried to renege on a privacy policy that promised not to sell customer information or mailing lists.

That led to an intervention by the Federal Trade Commission, which advised the electronics chain to sell the information only as a package with its retail stores.

The hedge fund Standard General bought Radio­Shack’s business and customer data for $26.2 million.

Dick’s, which did not respond to requests for comment, could find many uses for the Sports Authority data.

Considering that Dick’s also spent $8 million to obtain 31 Sports Authority leases in this week’s auction, it could use the data to see if there are specific regions where customers seem particularly loyal to Sports Authority.

Still, privacy experts say any movement of personal data raises security concerns.

“The type of company that would be most entertained by that information is most likely to exploit it,” said Jay Edelson, a Chicago privacy attorney. “Whether it’s identity theft or a scheme to defraud people by selling other things to them or reselling that list.”

Sports Authority and Hilco Streambank, which facilitated the auction, declined to comment.