Fortnite Class Action Says Accounts Sold on Dark Web

Epic Games, the designer of popular video game Fortnite, faces a class action alleging that consumer information was compromised in a data breach.

Fortnite is a popular battle-royale video game that has swept the nation since its release. There are around 80 million people who play the game every month and around 200 million total registered users on computer, console, and mobile platforms.

In his recent Fortnite class action, plaintiff Michael Heidbreder claims that “a flaw in Fortnite’s code” allowed hackers to collect the personal information of the 200 million players who have registered as users.

Epic Games reportedly announced the data breach in January 2019 but did not disclose important information including the data breach time frame and the number of accounts affected. Additionally, the company has reportedly failed to inform affected individuals if their personal information has been affected.

Heidbreder argues that Epic Games only acknowledged the data breach publicly because cybersecurity firm Check Point Software Technologies discovered the game’s vulnerabilities and disclosed their findings in November 2018.

The source of the data breach reportedly comes from Fortnite’s single sign on setup. This allows users to log onto multiple services with the same third party account, whether that be from Epic Games, Xbox, Google, or other accounts.

If a player logs into their third party account, they can reportedly access their Fortnite information by requesting an “access token” to the game.

According to the Fortnite data breach class action, hackers “exploited” this set up by sending out phishing links on social media or forum posts. These links claimed to be Fortnite promotions. When consumers clicked the links, they were reportedly prompted to log into their Fortnite account through their third party account.

“But instead of having the third-party account send the security token to the legitimate login, hackers redirected those users to an old, unsecured URL maintained by Epic Games,” the Fortnite class action claims. “Check Point’s research revealed that hackers could embed that URL with malicious JavaScript allowing them to steal Fortnite access tokens which they could then use to take over users’ accounts.”

The Fortnite class action states that the data breach compromised important information such as credit and debit cards. Payment information was allegedly used to purchase in-game products and currency without consumer permission.

Additionally, many players allegedly found themselves unable to access their accounts after they were stolen. Hackers reportedly loaded up accounts with in-game currency, changed the log in information, and sold the accounts on the dark web.

Heidbreder seeks to represent a Class of consumer whose personal information was accessed, compromised, or stolen from Epic Games in the Fortnite data breach. The Fortnite class action lawsuit also includes a statewide Class of the same consumers from Missouri.

The Fortnite class action seeks actual damages, compensatory damages, consequential damages, statutory damages, punitive damages, penalties, restitution, disgorgement, credit monitoring services, court costs, and attorneys’ fees.

Heidbreder and the proposed Class are represented by Ivy T. Ngo and Alexander F. Beale of Franklin D. Azar & Associates PC and by Martha Greer and Adam Langino of Cohen Milstein Sellers & Toll PLLC.

The Fortnite Data Breach Class Action Lawsuit is Heidbreder v. Epic Games Inc., Case No. 5:19-cv-00348-BO, in the U.S. District Court for the Eastern District of North Carolina.

Read More Lawsuit & Settlement News:

Google Pixel Speaker Defect Class Action Settles For $7.25M

Do I Need a Work Injury Lawyer in Memphis?

ThinkThin Class Action Says ‘Vanilla’ in Oatmeal is Misleading

What’s the Minimum Wage in California?