GameStop gamestop.com GameStop data breach 2017: what happened and what to do
Between August 10, 2016 and February 9, 2017, payment details entered on GameStop's website may have been exposed. GameStop confirmed it in 2017 and mailed notices in June. Card numbers, expiry dates, names, addresses and security codes could be involved. The number of people affected wasn't disclosed.
View all 13,115 breaches- Breach date
- 10 Aug 2016
- Made public
- 5 Jun 2017
- Data exposed
- Names, Physical addresses, Credit cards
- Last updated
What happened
GameStop confirmed in 2017 that online shoppers' payment data may have been exposed. According to its notice, the period ran from August 10, 2016 to February 9, 2017. The company first acknowledged the problem in April 2017 and sent notification letters in June, which drew criticism for the delay.
Press coverage of the notice says the exposed details could include card numbers, expiry dates, names, addresses and the three-digit security code. GameStop said its investigation found no evidence of unauthorized access to payment card data, but that the potential existed for certain transactions. It also said retail store customers were not affected, only people who bought online.
GameStop didn't publish a total for how many customers were involved. The notice was filed with the California and Washington Attorneys General.
If you shopped on GameStop's website during that six-month window, treat the card you used as exposed. A name, address and card details together also feed phishing that quotes a real order. The fix is a new card number, and a look at old statements for charges you don't recognize.
What to do if you were in it
- 1
Check your card statements
Look at every charge from the affected period and report anything you don't recognize to your bank. Most card issuers cap your liability for fraud if you report it quickly.
- 2
Ask for a new card if you used one
If you paid with a card during the affected window, ask your issuer to replace it. Card numbers, expiry dates and security codes can't be changed any other way.
- 3
Turn on transaction alerts
Set up text or app alerts for every purchase so fraud shows up in minutes, not on next month's statement.
- 4
Expect phishing that mentions the breach
Emails and texts that offer help with the breach are a common scam. Go to the company's website yourself instead of clicking links.
- 5
Check whether your email or phone is in other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web and alerts you when your details appear in a new leak.
Frequently asked
Was I affected by the GameStop data breach?
Possibly, if you bought on GameStop's website between August 10, 2016 and February 9, 2017. GameStop said in-store customers were not affected and mailed notices to online customers in June 2017.
What data was exposed?
Card numbers, expiry dates, names, addresses and security codes could be involved, according to press coverage of the notice.
How many people were affected?
GameStop didn't state a total in the notice.
Should I change my password?
Passwords weren't reported as exposed. Replace the card you used instead.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
