Fortnite data breach lands Epic Games with class action


In the wake of a data breach, that exposed personal details of Fortnite players in November 2018, that bred widespread account hacking, a class action lawsuit is being lined up against Epic Games.

The lawsuit is being prepared by US firm Franklin D Azar & Associates, which launched a call for users who were affected to contact them and join the action. The company, known as FDAzar, said: “You may have a claim against Epic Games if you have an Epic Games or Fortnite account, a credit or debit card linked to that account, and incurred charges on that linked card that you did not authorize or recognize. Contact FDAzar immediately. We will fight to get you the recovery you deserve.”

As we revealed in December 2018, hacking in Fortnite – in which players were taught to hack others’ accounts, locking them out and stealing rare skins and the like which could then be sold – had become prevalent at the time.

In its justification for the class action lawsuit, FDAzar said: “On January 16, 2019, Epic Games, creators of the Fortnite video game, acknowledged that a flaw in Fortnite’s login system allowed hackers to impersonate players and purchase in-game currency using credit or debit cards on file with the account. This acknowledgment came after Check Point, a cybersecurity research firm, successfully exploited a security vulnerability on an old, unsecured webpage operated by Epic Games. Check Point notified Epic Games of the vulnerability in November of 2018. Not until two months later did Epic Games acknowledge the flaw. Epic Games did not disclose how many accounts were affected by the data breach. Fortnite has an estimated 200 million registered users.”

In an Account Security Bulletin originally posted in late January 2019, Epic Games explained how hackers were using what were effectively phishing techniques to hack Fortnite accounts, saying: “Attackers frequently download password dumps – lists of username/password combinations – from third party sites and use credential stuffing to find out what other websites those credentials work on. When they are successful at logging in to those accounts, they see what trouble they can create for the account holder. In many cases, that appears as fraudulent V-Buck purchases.”

“We’ve seen several instances of account theft and fraud related to websites that claim to provide you free V-Bucks or the ability to share or buy accounts. Please never share your Epic account details with anyone.”

Epic Games said at the time that it was hunting down those password dumps, and attempting to: “Proactively reset passwords for player accounts when we believe they are leaked online.” But FDAzar believes that despite that action, Epic Games is still open to a class action lawsuit: “However, affected Fortnite users have suffered an ascertainable loss in that they have had fraudulent charges made to their credit or debit cards and must undertake additional security measures, some at their own expense, to minimize the risk of future data breaches including canceling credit cards associated with their Epic Games/Fortnite accounts and changing passwords for those accounts. Furthermore, Fortnite users have no guarantee that the above security measures will in fact adequately protect their personal information. Fortnite users, therefore, have an ongoing interest in ensuring that their personal information is protected from past and future cybersecurity threats.”

Particularly given that it took Epic Games so long to acknowledge and attempt to fix the Fortnite security issues (even though they were given widespread press coverage), it would seem that FDAzar has a credible basis to its class-action lawsuit.

If you or a relative were financially affected by Fortnite hacking, you might want to contact FDAzar, which can be done by clicking here.

Previous articleFormer id Software boss joins World War Z studio
Next articleFortnite, Apex Legends cheaters hit by malware
Steve Boxer
Steve Boxer has been writing about videogames since the early 1990s. His first console was an Atari VCS, and he misspent most of his youth in the 1980s in the arcades. As well as for Green Man Gaming, he can be found writing for The Guardian, Empire, TechRadar and Pocket-Lint. He’s currently having trouble deciding whether his favourite console is his Xbox One X or his Switch, and plays a wide range of games, but especially RPGs (he loves a good JRPG) action-adventure titles, shooters of all descriptions and driving games. Follow him here.