HackingRetail & ConsumerRetailCustomer Data InvolvedTargetedIdentity (basic)Financial accountMediumContained

GAMESTOP CORP.

bd_a388ffe5e7490fee · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 3, 2017

Filed

Jun 5, 2017

To disclose

9 weeks

Affected

27,956state residents only

Linked

9 filings

Confidence

68%

Full breach record for GAMESTOP CORP. →3 incidents on file

GameStop, Inc. notified the Washington Attorney General of a security incident involving unauthorized access to its network. The incident affected 27,956 Washington residents who placed orders between August 10, 2016, and February 9, 2017. Accessible data included names, addresses, and payment card details. GameStop identified the access on April 3, 2017, and mailed notifications on June 2, 2017.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 236 days

discovery → filing · 9 weeks / 63 days

Aug 10, 2016

Begins

Apr 3, 2017

Discovered

Jun 5, 2017

Filed

vs. sector median

+1 wks slower

This filing is one of 9 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Oregon State AGbd_0461f797cafc69f62017-06-05Candidate
New Hampshire State AGbd_2ec17338145dccb82017-06-05Verified
Montana State AGbd_77b28055f9918e8b2017-06-05Verified
Massachusetts State AGbd_7e6c263e05cca3772017-06-05Verified

Show 4 more filings ↓up to 2d gap

California State AGbd_ebe2b9d6a78f40fa2017-06-05Verified
Massachusetts State AGbd_4f974a95bf47ed502017-06-06 · +1dVerified
New Hampshire State AGbd_82333776d35cff242017-06-06 · +1dVerified
South Carolina State AGbd_8b5aa0de08781c4e2017-06-07 · +2dVerified

Name: GAMESTOP CORP.
norm: gamestop

Name: GAMESTOP CORP.
norm: gamestop
Industry: Retail & Consumerllm

Discovered: Apr 3, 2017
Breach occurred: Aug 10, 2016 – Feb 9, 2017
Undetected for: 236 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 2, 2017
Affected individuals: 27,956state-resident count only
Data types: Identity (basic)Financial account
Data elements: NameFinancial account number
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 200-299dexposure 100-199d
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Attorney General Bob Ferguson

During the incident: Began an investigation
Provided written notification via U.S. Mail to 27,956 Washington residents
Provided a telephone number for affected individuals to call with any questions
Changes made: Continuing to take steps to strengthen the security of its network
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(63 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 7 states

View merged incident ↗

Oregon State AGJun 5 · first

New Hampshire State AGJun 5 · first

Montana State AGJun 5 · first

Massachusetts State AGJun 5 · first

California State AGJun 5 · first

Washington State AGJun 5 · first · this page

Massachusetts State AG+1d

New Hampshire State AG+1d

South Carolina State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9710.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 5, 2017
Raw hash: 72099837ddffa872cafb4434bf1a5e89c146ac78b74066181e42a3b7785b62ba

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityGAMESTOP CORP.

Victim entityGAMESTOP CORP.

Incidentdiscovered Apr 3, 2017

Stated responseBegan an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com