After they requested the personal data of their customers in Fallout 76 in support tickets, Bethesda Software LLC exposed these tickets to the public, allowing anyone to view them, edit them, and resolve them.
Support tickets were accessible to those who submitted their own, with requests containing usernames, addresses and email being opened by other people automatically for a limited period of time.
“From our research, we learned that on December 5, 2018 there was a brief period during which customers visiting the customer support website could have the ability to view customer support tickets that other customers had submitted during the same time period, “said Bethesda.
However, according to Bethesda, passwords and credit card numbers were not disclosed during the incident that affected the customer support website.
“We discovered an error on the customer support website that allowed some customers to view support tickets submitted by a limited number of other customers for a short period of time. After the discovery, we immediately took down the site to fix the bug”, added Bethesda.
Additionally, Bethesda reported that during this exposure at least 123 customer support tickets were affected, of which approximately 65 contained personal data.
Additionally, Bethesda said in a tweet that “Based on the current investigation, we believe that this exposure lasted about 45 minutes.”
Bethesda has launched an investigation to find the exact issue that caused the customer support website glitch and will provide further updates as any additional information about the data protection breach incident becomes available.
Since the EU GDPR regulation came into effect in May 2018, Bethesda could be fined up to €20 million or up to 4% of its annual global turnover if EU were affected by the data breach.
It is also important to mention that not all GDPR violations will ultimately lead to fines; the company's compliance with the GDPR , ultimately leading to a reduction in the amount of the penalty.
