Connect with us

Hi, what are you looking for?


Data Protection

SCUF Gaming Exposes Data on 1.1 Million Customers

Video game peripherals maker SCUF Gaming recently exposed to the web a database containing information on more than 1.1 million users.

Video game peripherals maker SCUF Gaming recently exposed to the web a database containing information on more than 1.1 million users.

The database appears to have been exposed to the Internet for 48 hours before being secured on April 3, but that was enough for a third-party to discover and access it, and also place a note there, claiming that the information was stolen.

“Your Database is downloaded and backed up on our secured servers. To recover your lost data, Send 0.3 BTC to our BitCoin Address and Contact us by eMail,” the note read, according to Comparitech, the security firm that discovered the exposure.

The database was indexed by search engine BinaryEdge on April 2, and was discovered by Comparitech’s Bob Diachenko on April 3. He immediately alerted SCUF Gaming, which secured the database within hours after being notified.

In a notice on Friday, the company confirmed the exposure, but claimed that only a bot had connected to it, and all the bot did was place a note saying the information was stolen.

“We have no evidence that either the bot or any other actor was able to misappropriate customer data,” the company says.

According to SCUF Gaming, the incident affected a single system, which was being operated off-site due to the current COVID-19 crisis.

The company says customer orders, returns and repairs, and other “non-sensitive customer information” were stored in the database. The peripherals maker also admitted that names, email/shipping/billing addresses, SCUF order history, and returns and repairs history details were included.

Advertisement. Scroll to continue reading.

Comparitech says the database contained 1,128,649 user records (full names, email addresses, billing addresses, shipping addresses, phone numbers, and order histories), 991,478 payment records (order numbers, partial credit card numbers, credit card expiration dates, order amounts, and transaction IDs), 754 SCUF Gaming staff records (usernames, full names, encrypted passwords, email addresses, user roles, and session IDs), and 144,379 records with repair order details.

SCUF Gaming says that, for orders processed before March 28, 2019, the stored information also included the last four digits of payment cards and payment card expiration dates.

“Please rest assured, there is no risk of exposed customers’ full credit card numbers, credit card CVV numbers, user names, encrypted customer passwords, or any card information for orders processed via PayPal or other payment methods,” the company notes.

SCUF also revealed that it is in the process of directly notifying all affected customers and that it has launched an in-depth security audit to ensure other systems and databases remain secure.

Related: New Marriott Data Breach Impacts Up to 5.2 Million Guests

Related: GE Says Some Employees Hit by Data Breach at Canon

Related: Cruise Operator Carnival Discloses 2019 Data Breach

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.


Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Artificial Intelligence

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.


The three primary drivers for cyber regulations are voter privacy, the economy, and national security – with the complication that the first is often...

Artificial Intelligence

Two of humanity’s greatest drivers, greed and curiosity, will push AI development forward. Our only hope is that we can control it.

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...

Data Protection

While quantum-based attacks are still in the future, organizations must think about how to defend data in transit when encryption no longer works.