Support NeoGAF

[LordOfLore]

Link.

Video game giant GameStop Corp. says it is investigating reports that hackers may have siphoned credit card and customer data from its website — gamestop.com. The company acknowledged the investigation after being contacted by KrebsOnSecurity.

“GameStop recently received notification from a third party that it believed payment card data from cards used on the GameStop.com website was being offered for sale on a website,” a company spokesman wrote in response to questions from this author.

“That day a leading security firm was engaged to investigate these claims. Gamestop has and will continue to work non-stop to address this report and take appropriate measures to eradicate any issue that may be identified,” the company’s statement continued.

Two sources in the financial industry told KrebsOnSecurity that they have received alerts from a credit card processor stating that Gamestop.com was likely compromised by intruders between mid-September 2016 and the first week of February 2017.

Those same sources said the compromised data is thought to include customer card number, expiration date, name, address and card verification value (CVV2), usually a 3-digit security code printed on the backs of credit cards.

Online merchants are not supposed to store CVV2 codes, but hackers can steal the codes by placing malicious software on a company’s e-commerce site, so that the data is copied and recorded by the intruders before the data is encrypted and transmitted to be processed.

GameStop would not comment on the possible timeframe of the suspected breach, or say what types of customer data might be impacted.

Based in Grapevine, Texas, GameStop generated more than $8.6 billion in revenue in 2016, although it’s unclear how much of that came through the company’s Web site. GameStop operates more than 7,000 retail stores through the United States, Canada, Australia, New Zealand and Europe. There is currently no indication that the company’s retail store locations may have been affected.

According to Web site statistics firm Alexa.com, Gamestop.com is the 269th most popular Web site in the United States.

“We regret any concern this situation may cause for our customers,” Game Stop said in its statement. “GameStop would like to remind its customers that it is always advisable to monitor payment card account statements for unauthorized charges. If you identify such a charge, report it immediately to the bank that issued the card because payment card network rules generally state that cardholders are not responsible for unauthorized charges that are timely reported.”

Close if old.

 

[LiK]

Gaddammit.

 

[benicillin]

mid-September 2016 and the first week of February 2017

Oh, so before I preordered Destiny 2. Phew. Still going to keep an eye on my stuff though.

 

[pelicansurf]

That would suck.

 

[Hellsing321]

Welp looks like it's time to get a new credit card again.

 

[deletethis123]

Oh, so before I preordered Destiny 2. Phew. Still going to keep an eye on my stuff though.

I thought the same. I'll remove my credit card info just in case.

 

[Salty Rice]

Luckily i never bought anything from Gamestop in my life and never will.

But such a data going out always sucks for costumers.

 

[Mihael Mello Keehl]

Never bought anything on gamestop with my new cards so

 

[Soroc]

Man I'm really happy I haven't bought anything from Gamestop in several years. Sorry for those that might be compromised, make sure to keep tabs on your CCs and check sites like haveibeenpwned.com

 

[KaYotiX]

2013 was the last time I bought from Gamestop.

I should be safe hopefully

 

[InsaneTiger]

Here we go.

 

[spons]

You might have to use a prepaid credit card for sites like this where security is a sideshow (or more likely a shitshow).

 

[friskykillface]

Fuck
Welp
That sucks since I've used my card on that site numerous times

 

[The Albatross]

Gamestop's user management system is so shitty I can't even log in to my legitimately owned account, so I can't imagine a hacker being able to do it either.

That's some next level shit.

I've never successfully bought anything from Gamestop.com, though I did buy a Nintendo 3DS from the store a few years ago. The onyl time I ever used gamestop.com, though, of course, was for the Nintendo NES Classic, which I "bought" was charged for, and then Gamestop canceled the order before shipping. Naturally... It was November 2016, so I'm probably fucked. Goddamnit. Gamestop took the order, charged me, never shipped the item, and then after Christmas canceled the order with no explanation and refunded me... Basically getting an interest free loan from me for a month and ruined my sister's Christmas gift from me. Makes perfect sense that their shoddy web security, to go along with every other second-rate anticonsumer bull shit that they do would get hacked and give up fucking CVV2 details.

*edit*

Oooh, maybe I used paypal. Good thinking ViciousDS.

Oh, thank god, I used PayPal.

 

[ViciousDS]

I use paypal on gamestop.......so.....good luck

 

[DeuceGamer]

Not good. Think I ordered a couple things online that were sold out elsewhere. Will need to check to confirm...

 

[Neptonic]

I read this as GameSpot and freaked out that my GiantBomb subscription payment information was part of this.
Thank god I don't buy games at GameStop

 

[friskykillface]

I bought stuff on Black Friday so I'm fucked lol
Just remembered buying the new 3DS
Welp again

 

[DeuceGamer]

Is the best course of action to go ahead and start ordering new cards before the potentially breached ones are used?

 

[thebigmachine]

I did have credit fraud recently and I did buy Hitman on there, I wonder if they are connected.

 

[Mister_Ruck]

Of course the only time I've ordered something from them in the last 10 years happens to fall right in the middle of those dates.

 

[RPGam3r]

The card I was using to buy the Switch was already stolen so go right ahead and try to use!

 

[DeuceGamer]

I did have credit fraud recently and I did buy Hitman on there, I wonder if they are connected.

You know, I actually had a fraud attempt in January so that may be why. The Bank didn't process it and alerted me so no harm was done. I bet this is why actually.

 

[dgco86]

I'm probably still screwed if I placed a preorder for something in January and was charged for it in March, right? -_-

 

[Zap Rowsdower]

Of course the only time I've ordered something from them in the last 10 years happens to fall right in the middle of those dates.

That would be kind of the case for me too but I payed through Paypal so I'm golden.

 

[NateDrake]

Wonder if this is why I suddenly have a subscription to Fortune magazine...

 

[whiteninja]

I recently had to get a new card thanks to a fraudulent transaction just a few weeks ago. Thanks gamestop!

 

[ev0]

I had a fraud attempt a few months ago and had no idea why. This probably explains it.

 

[Shmuppers]

I've made the switch to walmart/target for games. Something always goes wrong when I try to buy something at Gamestop.

 

[eggandI]

"Investigating possible breach" = they took everything

lmao glad i didnt get my 3ds from them last year

 

[j0hnnix]

Breach only stole "used" information because they do not carry new.

 

[Saroyan]

Well damn, I just checked and I made two purchases from Gamestop in January.

 

[Majima Everywhere System]

Amazing, the hackers got something out of Gamestop without being asked if they want to preorder.

I guess Gamestop passed up the 2 year credit card data protection plan in case of cracks.

Hackers attempted to steal encrypted information, but unfortunately the only copy Gamestop had left was unencrypted.

 

[MageBoySA]

Bought my PSVR from them on Feb 8th but just found by PayPal receipt and breathed a sigh of relief.

 

[thesaucetastic]

You're safe if you've bought something from a physical store with a credit card, right?

 

[RootCause]

Oh, hell! :/

 

[Cody_D165]

As a credit union employee I look forward to yet another round of replacement debit cards and disputed charges thanks to a merchant who doesn't have their shit together.

-_-

 

[The Futurist]

I'm genuinely shocked every time I see the amount of people that shop at gamestop.

 

[jbug617]

I bought something as a guest account. I also tried to make an order but the cancelled it late last year.

 

[RootCause]

I ordered the FE Echoes Special Edition from them on March 21.

 

[Tubie]

for fucks sake

I bought something from them during the black Friday sale, so this probably affects me as well.

 

[Ouroboros]

poop. I have my main card on that site.

 

[Diablos]

They're already struggling. This might be the final nail.

 

[mindatlarge]

Last thing I bought from GameStop in many years was a Switch. But that was in-store, so I should be good, hopefully. Hope it works out for everyone else. This sort of thing sucks.

 

[PeskyToaster]

I've purchased stuff in store but only one thing online and that was with paypal. This kind of stuff makes personal security basically useless. No need to inconvenience yourself when the merchants are just basically pinatas for criminals.

 

[Quadraphonic]

Those same sources said the compromised data is thought to include customer card number, expiration date, name, address and card verification value (CVV2), usually a 3-digit security code printed on the backs of credit cards.

They have the god damn security code, too? Jesus fuck.

 

[FinKL]

I'm genuinely shocked every time I see the amount of people that shop at gamestop.

I needed a Nintendo Mini!

Also $3 Funkos

 

[nicanica]

So are the hackers going to repackage the cards and resell them?

Or allow you to get the info back by trading in 7 credit cards in return?

 

[jony_m]

Do the physical stores have the new CC chip readers or old school swipe?

I can't remember, I was there in JAN... first time in years... but it sounds this is online only.

 

[Defect]

Ugh, time to get a new card.