GameStop Admits Hackers Had Access to Its Website for Six Months
Video game and electronics retailer GameStop has started warning customers that their personal details and payment card data may have been stolen by cybercriminals.
Security blogger Brian Krebs reported on April 7 that the GameStop.com website had apparently been breached. Krebs learned at the time from his sources in the financial industry that hackers had stolen names, addresses and card data entered on the site between mid-September 2016 and early February 2017.
The company confirmed at the time that it had launched an investigation, but it only started notifying each impacted customer last week, specifying which of their payment cards may have been compromised.
“Although the investigation did not identify evidence of unauthorized access to payment card data, we determined on April 18, 2017 that the potential for that to have occurred existed for certain transactions,” the company wrote in a letter mailed to customers.
It turns out that hackers had access to the company’s website between August 10, 2016, and February 9, 2017. During this time, the cybercriminals may have stolen information provided when an order was placed, including names, addresses, card numbers, card expiration dates, and CVV codes. Payments made in stores do not appear to have been impacted.
The company has not shared any information on how many of its customers have been affected by the breach.
GameStop has provided some recommendations on how impacted customers can protect themselves, but it has not offered to pay for any specialized fraud protection services. The company has promised to enhance the security of its network to prevent future incidents.
Related Reading: Chipotle Investigating Payment Card Breach
Related Reading: Hundreds of Arby’s Restaurants Hit by Card Breach
Related Reading: Over 200 Brooks Brothers Stores Hit by Payment Card Breach
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Zyxel Firewalls Hacked by Mirai Botnet
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations
- Zero-Day Vulnerability Exploited to Hack Barracuda Email Security Gateway Appliances
- OAuth Vulnerabilities in Widely Used Expo Framework Allowed Account Takeovers
- New Honeywell OT Cybersecurity Solution Helps Identify Vulnerabilities, Threats
- Rheinmetall Says Military Business Not Impacted by Ransomware Attack
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
