2026 GameStop — forum sale claim (unverified); 54M+ customer records alleged
Data compromised
Actor-claimed customer accounts: user IDs, names, dates of birth, emails, phones, addresses, ZIP codes, account status, creation dates, and last purchase dates; Cybernews reviewed 86 sample rows with some 2026 purchase dates
Technical writeup
Unverified criminal-marketplace claim — indexed June 30, 2026. Cybernews reported a seller advertising more than 54 million alleged GameStop customer records on an illicit marketplace, publishing 86 sample rows containing names, DOBs, contact data, addresses, and purchase metadata—some samples showed 2026 last-purchase dates suggesting partial freshness rather than a pure historical mash-up. Cybernews could not verify total volume from samples alone; GameStop had not issued a matching breach notice at catalog time. German trade press (Cybernews DE) covered the same listing under "Datenleck" framing. Distinct from GameStop's verified 2017 in-store POS malware incident. BreachHistory uses the seller-cited 54M count labeled unverified.
Root cause
Unverified illicit-marketplace listing advertising alleged GameStop customer database—GameStop had not confirmed at catalog time