GameStop Class Action Lawsuit Filed Over Data Breach

GameStop Corporation is facing a class action lawsuit that accuses the company of failing to adequately safeguard customers’ financial data, leading to a six-month-long data breach that compromised the debit and credit card numbers of an unknown number of customers.

Plaintiffs Crystal Bray and Samuel Cook allege their payment card numbers were stolen in a data breach that took place from August 2016 through February 2017, which they claim was “the inevitable result of GameStop’s inadequate data security measures and cavalier approach to data security.”

Bray and Cook claim they made purchases online during the six-month period that GameStop was allegedly being affected by the data breach, and that they were notified about the GameStop data breach via letters dated June 2. The letter did not offer any credit monitoring services or compensation for losses stemming from the data breach, the GameStop class action lawsuit asserts.

GameStop reportedly confirmed in April that it was investigating the data breach. According to the GameStop data breach class action lawsuit, GameStop was notified by a third party that customer data was being offered for sale online.

The GameStop class action lawsuit notes that debit and credit card information is a frequent target of hackers who may use the data to make fraudulent purchases and potentially perpetrate identity theft. The plaintiffs allege GameStop’s security measures do not meet industry standards and violate guidelines established by the Federal Trade Commission.

Bray and Cook, along with the putative Class Members, have “been forced to spend significant time associated with, among other things, closing out and opening new credit or debit card accounts, ordering replacement cards, obtaining fraud monitoring services, losing access to cash flow and credit lines, monitoring credit reports and accounts, and/or other losses resulting from the unauthorized use of their cards or accounts,” the GameStop data breach class action lawsuit says.

According to the GameStop class action lawsuit, Bray and Cook had more than $7,600 fraudulent charges and withdrawals that they claim are related to the GameStop data breach. They were able to recover their funds, but only after spending several hours attempting to address the problem.

Bray and Cook filed the GameStop data breach class action lawsuit on behalf of themselves and a nationwide Class of GameStop customers who used a credit or debit card to make a purchase on www.GameStop.com between Aug. 10, 2016 and Feb. 9, 2017. They also seek to represent a Class of Indiana consumers and a Class of North Carolina consumers.

The GameStop data breach class action lawsuit asserts claims for negligence, negligence per se, breach of contract, breach of implied contract, unjust enrichment, violation of the Indiana Deceptive Consumer Sales Act, and the North Carolina Unfair and Deceptive Trade Practices Act.

The plaintiffs are seeking actual damages, restitution and disgorgement; equitable, injunctive and declaratory relief; pre- and post-judgment interest; attorneys’ fees and costs; and other relief deemed appropriate by the court.

Bray and Cook are represented by Robert J. Kriner Jr., Vera G. Belger, Benjamin F. Johns, Andrew W. Ferich and Jessica L. Titler of Chimicles & Tikellis LLP and Cornelius P. Dukelow of Abington Cole & Ellery.

The GameStop Data Breach Class Action Lawsuit is Crystal Bray, et al. v. GameStop Corp., Case No. 1:17-cv-01365, in the U.S. District Court for the District of Delaware.

UPDATE JULY 18, 2018: GameStop Corp. agreed to settle a data breach class action lawsuit over allegations it failed to adequately safeguard consumers’ data.

UPDATE 2: September 2018, the GameStop data breach class action settlement is now open. Click here to file a claim.