GameStop Responds To Alleged Customer Data Leak
On November 26, a user on Reddit reported an incident regarding personal data on GameStop's website. The post alleged that personal information from other users — including "name, phone number, address, [and] order history" — appeared when refreshing the page. Throughout the post's comment section, other Reddit users shared that they had encountered the same issue, seemingly confirming that GameStop was experiencing a data leak that displayed other customers' private information when users attempted to sign in to their accounts. There was also at least one report of a full credit card number displaying.
The purported data leak is the most recent event in a string of GameStop-centered incidents pertaining to customer privacy. In September, the video game retail chain faced accusations of serious privacy violations when a lawsuit claimed that the company had illegally wiretapped its customers' chats and sold the recorded conversations to third-party companies. Combine that with the incredibly divisive announcement of the company's plan to launch an NFT marketplace, and it's apparent that GameStop is jumping from one controversy to another, especially when it comes to private customer information.
The retailer has since released a response regarding the alleged data breach. According to GameStop, the whole situation was a huge misunderstanding.
GameStop claims that the data leak was simply a test
Responding to a request for comment from Video Games Chronicle, GameStop's Customer Care team asserted that the alleged data leak wasn't what it seemed like. According to the statement, it was simply a component of a test that the company was conducting and the information that users viewed wasn't authentic. "This was immediately fixed the same day it took place," GameStop Customer Care told VGC. "This was test data created by our teams, not actual customer data."
According to VGC, there may be more to the situation than GameStop has acknowledged. Along with the comment provided by GameStop Customer Care, VGC's Andy Robinson asserted that some of the information that GameStop website users saw could be genuine. "An online search suggests that some of the names and addresses that were shown to customers on its website could match real people," an update to the initial article read. "VGC has asked if real address data was used." At the time of this writing, GameStop had not responded to VGC's question about the authenticity of the information certain users gained access to.