HackingRetail & ConsumerRetailStolen CredentialsCustomer Data InvolvedData ExfiltratedPIIFinancial accountIdentity (basic)MediumContained

GAMESTOP CORP.

bd_8b5aa0de08781c4e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 18, 2017

Filed

Jun 7, 2017

To disclose

7 weeks

Affected

18,016state residents only

Linked

9 filings

Confidence

64%

Full breach record for GAMESTOP CORP. →3 incidents on file

GameStop, Inc. notified South Carolina customers that payment card information (including CVV) for transactions between Aug 10, 2016 and Feb 9, 2017 may have been accessed by unauthorized third parties. GameStop engaged forensic experts and alerted law enforcement. No specific count of affected individuals was provided in the filing.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due7 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 251 days

discovery → filing · 7 weeks / 50 days

Aug 10, 2016

Begins

Apr 18, 2017

Discovered

Jun 7, 2017

Filed

vs. sector median

on median

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Massachusetts State AGbd_4f974a95bf47ed502017-06-06 · +1dVerified
New Hampshire State AGbd_82333776d35cff242017-06-06 · +1dVerified
Oregon State AGbd_0461f797cafc69f62017-06-05 · +2dCandidate
New Hampshire State AGbd_2ec17338145dccb82017-06-05 · +2dVerified

Show 4 more filings ↓up to 2d gap

Montana State AGbd_77b28055f9918e8b2017-06-05 · +2dVerified
Massachusetts State AGbd_7e6c263e05cca3772017-06-05 · +2dVerified
Washington State AGbd_a388ffe5e7490fee2017-06-05 · +2dVerified
California State AGbd_ebe2b9d6a78f40fa2017-06-05 · +2dVerified

Name: GAMESTOP CORP.
norm: gamestop

Name: GAMESTOP CORP.
norm: gamestop
Industry: Retail & Consumerllm

Discovered: Apr 18, 2017
Breach occurred: Aug 10, 2016 – Feb 9, 2017
Undetected for: 251 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 2, 2017
Affected individuals: 18,016state-resident count only
Data types: PIIFinancial accountIdentity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 ChannelT1056 Input Capture
Threat actor: ExternalFinancial
Regulator citations: alerting law enforcement
Initial access: exploit_public_facing

During the incident: Initiating an internal review
Engaging independent forensic experts to assist us in the investigation and remediation of our systems
Alerting law enforcement
Changes made: Continuing to take steps to strengthen the security of our network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(50 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 7 states

View merged incident ↗

Oregon State AGJun 5 · first

New Hampshire State AGJun 5 · first

Montana State AGJun 5 · first

Massachusetts State AGJun 5 · first

Washington State AGJun 5 · first

California State AGJun 5 · first

Massachusetts State AG+1d

New Hampshire State AG+1d

South Carolina State AG+2d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2017/GameStopInc..pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 7, 2017
Raw hash: 12ad9848fda531c10efb490e44f109d021e6a532ab91ba35e8dc6b10f4358c99

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityGAMESTOP CORP.

Victim entityGAMESTOP CORP.

Incidentdiscovered Apr 18, 2017

Stated responseInitiating an internal review

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov