Fortnite Class Action Lawsuit Alleges Player Payment Info Exposed

A gamer has lodged a class action lawsuit against Epic Games Inc., the makers of the popular multi-player game Fortnite, alleging his payment information was exposed in a 2018 data breach.

Plaintiff Eric Krohm alleges that hackers breached Epic’s financial systems in the summer of 2018.

“Security tokens” were reportedly accessed in the breach, affecting credit and debit card information consumers use to purchase money used in the game called “Vbucks.”

“Such security token jacking schemes are increasingly common, and any reasonably robust cybersecurity and information technology regime must account for the ultimate disposition, including reusability, of security tokens,” states the Fortnite class action lawsuit. “Defendant has failed in this regard.”

The plaintiff says that he has had to spend his own time, efforts, and money to protect himself from identity theft and fraud because of the alleged Fortnite breach.

The Fortnite class action lawsuit alleges that Krohm became aware of the breach in November 2018 when he was informed by a cybersecurity research company. In addition to credit and debit card information, the plaintiff alleges that other personally identifiable information was accessed in the breach.

“After hijacking a respective player’s Fortnite account, a cyber-criminal is then able to make in-game purchases of Vbucks in order to resell the same on the criminal black market,” alleges the Fortnite data breach class action lawsuit. “Indeed, Defendant’s Vbucks currency is a lucrative item for cybercriminals, and Defendant is fully cognizant of the substantial criminal activity surrounding the fraudulent acquisition of Vbucks.”

Further, cybercriminals accessed not only financial and personal information, but may also be able to secretly listen to player conversations on the multi-player Fortnite game, alleges the class action lawsuit.

According to the Fortnite class action lawsuit, Epic failed to take simple security measures that would have protected the financial information of players.

“Defendant’s lax cybersecurity policies and procedures created the Vulnerability that allowed hackers to obtain access to Plaintiff’s and other players’ [personally identifiable information] and Payment Information,” the Fortnite data breach class action states.

The plaintiff says that Epic failed to inform him and others affected by the Fortnite breach in a timely fashion, further exposing them to identity theft and fraud.

“Even if [sic] the [personally identifiable information] and Payment Information made available to backers as a result of the Vulnerability is not being presently used for identity theft, any such PII and Payment Information that has been stored and/or sold for future misuse and/or sale are likewise at highly imminent risk of unauthorized disclosure,” contends the Fortnite class action lawsuit.

The Fortnite class action lawsuit seeks to represent a nationwide Class of consumers whose payment or personal information was in possession of Epic between November and December 2018, along with an Illinois subclass.

Krohm is represented by Myles McGuire, Jad Sheikali and Timothy P. Kingsbury of McGuire Law PC.

The Fortnite Data Breach Class Action Lawsuit is Eric Krohm v. Epic Games Inc., Case No. 2019­-CH-02032, in the Circuit Court of Cook County, Illinois.