Support NeoGAF

[Chris1]

They have updated the message when you try to update your card details.

"
Update 24/1/2015

Updating Your Card Details
Please accept our apologies, we are currently changing our payment platform.
You should be able to add your new card details from Wednesday 28/1/2015.

The Changes
The new platform will look a little different. When you update your card details, you will be directed to our Payment Partner page to enter your card details and then back to our site afterwards.

You won’t have to do more than you would do ordinarily, it will just look a little different and is totally secure.

Waiting for a Game?
We are still receiving and despatching rentals during this period including new releases. You should also be able to manage the rest of your account as normal.

However, if you are currently waiting for a game, because your account needs new card details, please email us at customersupport@boomerangrentals.co.uk with email subject “Allocate Game” and will despatch a game to you as quickly as we can. This is only a temporary measure, just while we wait for the new payment platform to go live.

Thank you for your patience, we will let you know when you will be able to update your card details, as soon as we can."

Are they still denying they were the cause of it?

That sounds like admittance to me.. why would they bother upgrading their security systems if according to them it was already secure and hadn't been compromised? Of course it's a good thing they're actually upgrading their security, they need to just admit it and get on with it, tapdancing around the problem just confuses your customers and is more likely to make them not come back than if you were to just be honest. At least if they admit it those who haven't been hit can take precautions.

 

[Lagamorph]

In a roundabout way, they're still denying it as far as I can tell.

If you go to the cancellation page you also get this message,

Get £12 worth of Payback Points and Exclusive Access to Bonus Games

We very sorry if you have been affected by the recent website issues and to show our appreciation, we would like to give you these exclusive offers.


If you are a live account holder (even if you are waiting to update your payment details) on 26th January 2015, and feel you have been affected, email us and we will sign you up to this offer, and give your account “legend” status.


We will then give you £4 worth of Payback Points over the next 3 months* (starting in February) and as soon as available, give you 3 months exclusive access to Bonus Games.


What is Bonus Games?

Bonus Games allows you to rent additional games at no extra cost (just redeem your points).


You can rent these games for 2 weeks and allows you to double your games at home for that period**. So, if you are on a 2 game package, you could have up to 4 games at home at a time!


There will be titles available on most formats including PS4, Xbox One, PS3 and Xbox360.


What to do next?

Please email us on customersupport@boomerangrentals.co.uk and head you email “I am Legend” and we will sign you up as quickly as we can. Please use your Boomerang account email address.


We will then release more news on this offer.


Thank you for your understanding and patience.

All they're openly apologising for is the downtime the website has been going through. They know it was them, but they're doing everything they can to get out of admitting it. I think that annoys me even more than losing my details.

To be honest, I was planning on keeping up the subscription, they wouldn't be the first company to get breached like this and they wont be the last, but the fact that they wont even admit to it is probably what will make me cancel.

 

[TsunamiOfSwagger]

Got the money re credited to my account, but I am still unable to close my boomerang account. Sent them an email this morning, but no reply yet.
Also, if you try to cancel, it brings up a pop up saying they are sorry about the recent "website troubles", and they will give you some sort of crappy reward scheme if you stay.

 

[Turnstyle]

I got an email from them today to say I could add my new card details from tomorrow.

I haven't even been a customer for two years, and I wouldn't trust them to look after a cactus, let alone my bank details.

 

[Bananajama]

My old email has got the new payments email.

My current registered one doesn't.

What database system are they using...

 

[popo]

Has anyone had a look at the new payment system? Their twitter says it is live and they are sending out emails saying the same but I still get a popup window promising it with todays date.

 

[daninthemix]

Has anyone started getting emails from places like Chaterbate? I have, ever since my card was used. Wondering if it's related.

 

[Bananajama]

Apparently card details haven't been deleted as earlier stated but moved to an offline system.

So unless you've cancelled with them directly.

Expect to be charged still

 

[Roxas]

UPDATE: 6th February 2015
Investigation
The investigation is progressing with the authorised, Third Party specialist we have appointed.
This is at the forensic level and is detailed and painstaking work. As yet, they have not been able to find conclusive evidence of a breach or how this might have taken place. Of course, this could change, as the investigation progresses, and we will keep you informed on this.
Understanding what has happened and where, with regards to compromised card details is very important to us also.
Blanket Email
On 13th January, while the investigation was in its early stages, we did say that we would blanket email our customers, however, the next day, we were strongly advised by one of our Payment Partners not to do this and we were also aware of ICO Guidelines warning against “over-notification”.
We understand that this has disappointed many of you, and does seem to run against the idea of good customer service, however, we were so strongly advised against this course of action that we believed we should not send a Blanket Email.
We sincerely apologise that it has taken a while for us to address this. We were hoping to hear sooner and definitively, the results of the investigation, however, that has not been the case.
We are keeping customers who have asked to be kept informed, up to date via emails and have sent several bulk emails over the last 10 days.
New Payment Platform
Whatever the results of the investigation, in order to reassure our customers, we took the decision early on to move to a new Payment Platform, which provides even greater levels of security.
This is now live and we have started to process subscription payments using tokens only. We will be completing the Payment Platform work on the remaining site functionality over the coming week or so.
No full card numbers are stored on our systems, we just hold a token that we can use for future payments.
Every time, we process a payment, we simply present Sagepay with this token and they then match this up to card details stored securely on their systems.
We will hold the last 4 digits only, and expiry date for your card, for website administration, which is standard practice.
These are passed back to us, by Sagepay, when you update your card details, so the full card details do not enter our systems at all.
Updated Security Program
Although, the investigation is still ongoing, and even though, we will not store full card numbers, and in fact, no card details will be entered via our site, the appointed Third Party specialist will help us devise a plan for additional monitoring of website and system security, over and above our current PCI Compliance requirements.
This new platform and the additional security monitoring are part of our commitment to make renting and purchasing from Boomerang as secure as it possibly can be.
I am Legend
We emailed those registering for I am Legend on 28th January to confirm acceptance and we will be setting their account to this status next week and adding the first 400 points.
We expect that Bonus Games will go live around the end of February.

https://www.facebook.com/Boomerangrentals/posts/781559238579818

TLR - these clowns still think it is not their fault

 

[popo]

https://www.facebook.com/Boomerangrentals/posts/781559238579818

TLR - these clowns still think it is not their fault

Do you really believe that? I find it much more likely that they know it was their fault but they have been advised that unless they - or this third party investigation - finds any proof, that they should not admit to anything.

People on Reddit keep, sometimes gleefully, claiming that the ICO will fine them out of existence for the breach. If there is no proof, then the best way to curtail any ICO action would be to not admit anything and if some third party report also finds nothing - well that is all the better for boomerang.

 

[gossi]

Do you really believe that? I find it much more likely that they know it was their fault but they have been advised that unless they - or this third party investigation - finds any proof, that they should not admit to anything.

People on Reddit keep, sometimes gleefully, claiming that the ICO will fine them out of existence for the breach. If there is no proof, then the best way to curtail any ICO action would be to not admit anything and if some third party report also finds nothing - well that is all the better for boomerang.

There's two heads for this:

- business head, of course they aren't going to admit anything. I mean, look at the wording: "conclusive evidence". The payment gateway (SagePay) are known for being clowns in the industry, they will tell you not to admit anything (WorldPay are similar) for legal liability and insurance reasons.

- consumer head, of course they should notify people to check statements.

Somehow, those details got breached and widely misused. They successfully admitted nothing, so the ICO can't act. Well played, Boomerang.

 

[IdreamofHIME]

Sorry for the bump but can anyone log into the site?

It says my username and password are incorrect and when i tried to reset the password, it said my email wasn't recognized.

With all their hacking shenanigans, im worried some bastard has access to my account. I sent boomerang an email, but they are slow as shit in replying. Usually 2-3 days.

 

[CanUKlehead]

Sorry for the bump but can anyone log into the site?

It says my username and password are incorrect and when i tried to reset the password, it said my email wasn't recognized.

With all their hacking shenanigans, im worried some bastard has access to my account. I sent boomerang an email, but they are slow as shit in replying. Usually 2-3 days.

Hey, I was able to log in just now. Good luck, mate.

 

[popo]

twitter replies are much faster imo

 

[SnowFlakeCake]

So I was defending boomerang before but it all looks rosey from the other side until you get fucked yourself. That happened with me, someone rinsed £200 from my card and thankfully the great folks at Santander alerted me and have proceeded to give my money back. The most irritating part of this is that those bastards at Boomerang kept my debit card details, this is despite me going for the package where you pay one off for the year and that's it but these cunts kept all my card details on file! I still think they are so good with their actual service in regards to games but they handled this hack so fucking poorly and their practices are unacceptable.

If anyone here has used Boomerang before and you put your card details in at any time, cancel your card. The hackers have your details, there is no doubt about it and your turn will eventually come, for me it was just 3 days ago this all happened so they were working their way down. My card has been cancelled and a new one issued, I don't use the debit card often so not to fussed but I can see people that use their cards a lot being very pissed.

 

[dr_octagon]

Got an email from ICO saying they are aware of the issue and it's being investigated.

Boomerang advised the investigation was still ongoing and a report should arrive soon - nearly 4 weeks ago when I phoned them asking for an update.

 

[doniewhalberg]

Anyone here still use these guys that can say whether or not they ever got their shit together in regards to the hack, and new payment options? I miss the lovefilm days so much, and there are more game sI want to play than I can afford, I've love to have a good option for rentals again. These guys seem to be the biggest service around though, and I can find pretty much nothing in regards to the hack thing past january on google. Did they introduce paypal or anything? If they had a paypal option I think I'd sign up and give it a shot but otherwise, ehhh. Feel like I'm stuck between a rock and a hard place.

 

[EmiPrime]

Anyone here still use these guys that can say whether or not they ever got their shit together in regards to the hack, and new payment options? I miss the lovefilm days so much, and there are more game sI want to play than I can afford, I've love to have a good option for rentals again. These guys seem to be the biggest service around though, and I can find pretty much nothing in regards to the hack thing past january on google. Did they introduce paypal or anything? If they had a paypal option I think I'd sign up and give it a shot but otherwise, ehhh. Feel like I'm stuck between a rock and a hard place.

They never got their shit together, they denied all responsibility. Fuck them.

 

[popo]

They moved payment processing off site but never admitted to anything. Morally suspect but likely saved the business.

I am happy to continue using them but switched to a pre paid debit card.

 

[pswii60]

Boomerang continues to offer a great service, no issues with them at all from my point of view. Got Bloodborne day one, Witcher 3 day one. Never had any dodgy payments on my card. They still don't offer PayPal as far as I'm aware though.

 

[IdreamofHIME]

Im still using them. My post a few posts up about my password not working was sorted out by them within a day and apart from that i've had no other problems. No dodgy withdrawls from my bank account, although I actually keep a closer eye on my payments in and out since their fuckup.

 

[doniewhalberg]

Thanks for the replies guys. I'm glad to see some of you have had positive experiences with them since the problems at the beginning of the year/throughout but for peace of mind, I just don't think I could sign up without a change in payment options. IF I signed up and got ripped off, it really would be a huge I told you so haha. Are there really any other services at all that anyone uses? I spotted a paramount game rentals business also operating in the uk but the site looks like someone set it up over night haha.

 

[Triggerhappytel]

They have proved themselves dishonest by refusing to acknowledge there was an issue and email customers to warn them to check their accounts, until many weeks after they were made aware. Now they still won't accept responsibility.

So if you need them to help you for any reason at all then please do not trust them.

Inadequate security is an unfortunate mistake, lying and not caring about their customers is unforgivable.

I agree with this. Making a mistake is one thing, but denying all responsibility and failing to inform their customers is fucking disgusting. That "over-notification" mentioned in post 262 is steaming hot bullshit. Bastards should have at least sent out an email saying they had suspicions of security attacks but they take data privacy very seriously and that customers should be vigilant and monitor their bank accounts. It doesn't have to be written in such a way to make them look bad.

 

[pswii60]

Thanks for the replies guys. I'm glad to see some of you have had positive experiences with them since the problems at the beginning of the year/throughout but for peace of mind, I just don't think I could sign up without a change in payment options. IF I signed up and got ripped off, it really would be a huge I told you so haha. Are there really any other services at all that anyone uses? I spotted a paramount game rentals business also operating in the uk but the site looks like someone set it up over night haha.

No only Boomerang. Why not use a prepaid visa? They offer a great rental service so you are missing out otherwise.

 

[doniewhalberg]

No only Boomerang. Why not use a prepaid visa? They offer a great rental service so you are missing out otherwise.

Dunno man, just feels like if I have to jump through such hoops, it's a warning sign. Why should I have to over protect myself like that, when they could be offering stuff on their end that gives the customer piece of mind after what happened at the beginning of the year. I believe you that I'm probably missing out, it seems in terms of actual getting the games out and back etc they provide a good rental service, so I'll continue to keep an eye on them and make a move if they make some changes. I'll probably email them the same thoughts, let them know money is on the table from customers if they could just do a few things for piece of mind, but I imagine they already know this stuff.

 

[pswii60]

Dunno man, just feels like if I have to jump through such hoops, it's a warning sign. Why should I have to over protect myself like that, when they could be offering stuff on their end that gives the customer piece of mind after what happened at the beginning of the year. I believe you that I'm probably missing out, it seems in terms of actual getting the games out and back etc they provide a good rental service, so I'll continue to keep an eye on them and make a move if they make some changes. I'll probably email them the same thoughts, let them know money is on the table from customers if they could just do a few things for piece of mind, but I imagine they already know this stuff.

I would still drop them an email with your thoughts. I've always found their customer service to be good and they've come back to me quickly on any issues. Also check their Twitter account. Perhaps if I'd suffered an issue with a fraudulent transaction I would feel different but I can only judge them on my experience which has been flawless.