Video game peripherals maker SCUF Gaming recently exposed to the web a database containing information on more than 1.1 million users.
The database appears to have been exposed to the Internet for 48 hours before being secured on April 3, but that was enough for a third-party to discover and access it, and also place a note there, claiming that the information was stolen.
“Your Database is downloaded and backed up on our secured servers. To recover your lost data, Send 0.3 BTC to our BitCoin Address and Contact us by eMail,” the note read, according to Comparitech, the security firm that discovered the exposure.
The database was indexed by search engine BinaryEdge on April 2, and was discovered by Comparitech’s Bob Diachenko on April 3. He immediately alerted SCUF Gaming, which secured the database within hours after being notified.
In a notice on Friday, the company confirmed the exposure, but claimed that only a bot had connected to it, and all the bot did was place a note saying the information was stolen.
“We have no evidence that either the bot or any other actor was able to misappropriate customer data,” the company says.
According to SCUF Gaming, the incident affected a single system, which was being operated off-site due to the current COVID-19 crisis.
The company says customer orders, returns and repairs, and other “non-sensitive customer information” were stored in the database. The peripherals maker also admitted that names, email/shipping/billing addresses, SCUF order history, and returns and repairs history details were included.
Comparitech says the database contained 1,128,649 user records (full names, email addresses, billing addresses, shipping addresses, phone numbers, and order histories), 991,478 payment records (order numbers, partial credit card numbers, credit card expiration dates, order amounts, and transaction IDs), 754 SCUF Gaming staff records (usernames, full names, encrypted passwords, email addresses, user roles, and session IDs), and 144,379 records with repair order details.
SCUF Gaming says that, for orders processed before March 28, 2019, the stored information also included the last four digits of payment cards and payment card expiration dates.
“Please rest assured, there is no risk of exposed customers’ full credit card numbers, credit card CVV numbers, scufgaming.com user names, encrypted customer passwords, or any card information for orders processed via PayPal or other payment methods,” the company notes.
SCUF also revealed that it is in the process of directly notifying all affected customers and that it has launched an in-depth security audit to ensure other systems and databases remain secure.
Related: New Marriott Data Breach Impacts Up to 5.2 Million Guests
Related: GE Says Some Employees Hit by Data Breach at Canon
Related: Cruise Operator Carnival Discloses 2019 Data Breach