GameStop Admits Hackers Had Access to Its Website for Six Months
Video game and electronics retailer GameStop has started warning customers that their personal details and payment card data may have been stolen by cybercriminals.
Security blogger Brian Krebs reported on April 7 that the GameStop.com website had apparently been breached. Krebs learned at the time from his sources in the financial industry that hackers had stolen names, addresses and card data entered on the site between mid-September 2016 and early February 2017.
The company confirmed at the time that it had launched an investigation, but it only started notifying each impacted customer last week, specifying which of their payment cards may have been compromised.
“Although the investigation did not identify evidence of unauthorized access to payment card data, we determined on April 18, 2017 that the potential for that to have occurred existed for certain transactions,” the company wrote in a letter mailed to customers.
It turns out that hackers had access to the company’s website between August 10, 2016, and February 9, 2017. During this time, the cybercriminals may have stolen information provided when an order was placed, including names, addresses, card numbers, card expiration dates, and CVV codes. Payments made in stores do not appear to have been impacted.
The company has not shared any information on how many of its customers have been affected by the breach.
GameStop has provided some recommendations on how impacted customers can protect themselves, but it has not offered to pay for any specialized fraud protection services. The company has promised to enhance the security of its network to prevent future incidents.
Related Reading: Chipotle Investigating Payment Card Breach
Related Reading: Hundreds of Arby’s Restaurants Hit by Card Breach
Related Reading: Over 200 Brooks Brothers Stores Hit by Payment Card Breach