• The VOIDRUNNER'S CODEX is coming! Explore new worlds, fight oppressive empires, fend off fearsome aliens, and wield deadly psionics with this comprehensive boxed set expansion for 5E and A5E!

NuTSR Financial Data Breach

The ongoing saga of “TSR3” continues as Justin LaNasa, owner of “TSR LLC”, allegedly stores and has emailed to others a spreadsheet containing customer financial information stored without any form of encoding or encryption. In a video released by Don Semora of Wizard Tower Games, Semora claims Justin LaNasa emailed him a spreadsheet in May 2022 that included financial information from...

The ongoing saga of “TSR3” continues as Justin LaNasa, owner of “TSR LLC”, allegedly stores and has emailed to others a spreadsheet containing customer financial information stored without any form of encoding or encryption.

tsr3.jpg

In a video released by Don Semora of Wizard Tower Games, Semora claims Justin LaNasa emailed him a spreadsheet in May 2022 that included financial information from customers and business partners including full names, email addresses, home addresses, phone numbers, and even credit card numbers, all stored in plain text with no encoding or encryption. This includes customers of TSR or Dungeon Hobby Shop’s webstores purchasing products including Cult of Abaddon, Dungeon Crawl: The Board Game, TSR Dice, and others.


Screenshots of the spreadsheet (with private information redacted) show up in the video starting at the nine minute mark.

Wizard Tower Games also commented in the EN World thread “The Full & Glorious History of NuTSR” offering to confirm if anyone’s personal information was part of the spreadsheet he received. According to David Flor, transactions with the companies are processed under the name “Port City Kava”, an oxygen bar and vape/ecig store run by Justin LaNasa in North Carolina.

For those unfamiliar with the Saga of the TSR Trademark, EN World has a timeline of events with links to more information going back to the start in June of 2021 and, at the time of writing, updated through July 22, 2022.

The video from Semora is the most recent entry in a back-and-forth between himself and LaNasa following a Twitter post from Wizard Tower Games on August 29 confirming the company received two subpoenas related to the lawsuit with Wizards of the Coast. Michael K. Hovermale, former employee of TSR LLC, confirmed he also received a subpoena related to the lawsuit and confirmed in a post on EN World that he retained all information from his time working for LaNasa and informed LaNasa of this in June of 2022. In a video titled “OPEN LETTER LANASA” posted on September 1, Don Semora says he received a text message from LaNasa accusing Semora and Hovermale of “photoshopping documents”. The video consists of Semora posting screenshots of documents he claims were sent to him from LaNasa. In response, LaNasa claimed the documents in the video were Photoshopped by posting his own screenshots and calling Semora a "liar" on social media including in the title of a channel on the TSR Discord server, according to a screenshot from the private server posted by Kim Wincen. Semora responded with the video posted earlier today containing the spreadsheet along with other screenshots.

The trial between TSR LLC, the Dungeon Hobby Shop Museum LLC, and Justin LaNasa v. Wizards of the Coast is scheduled for a jury trial in October 2023.
 

log in or register to remove this ad

Darryl Mott

Darryl Mott

Sacrosanct

Legend
I'll post this here as well



He, as a merchant, is allowed to store:
  • The primary account number (PAN);
  • The cardholder’s name;
  • The service code;
  • The card’s expiration date.

He is NOT allowed (per the Payment Card Industry Security Standards Council (PCI SSC):

Based on the info you gave so far, I highly recommend anyone who used a credit or debit card report this breach to their issuing company. As mentioned above, they can face serious penalties by doing this, including an audit by the FTC if it's egregious.
 
Last edited:

log in or register to remove this ad




Abstruse

Legend
They had dollar store dice, that one adventure with the village of Morrus, and apparently some shirts with a (stolen art) DHSM/NuTSR logo on it.
And an adventure for children (if you'd dare trust these guys with anything "family friendly") plus there's a good chance the registration for all their conventions, donations for DHSM, etc. all went through the same service and were treated with the same level of security.
 

Dausuul

Legend
You're not supposed to store the main account number in clear-text, so far as I know. Like, ever.
Yeah, that is a gigantic no-no.

As a rule, you don't want credit card data to touch your systems at all if you can avoid it. It's much better all around to outsource credit card processing to a reputable company that specializes in that. Such companies aren't immune to data breaches, but they're a lot better than trying to DIY it.
 
Last edited:

RivetGeekWil

Lead developer Tribes in the Dark
I'll post this here as well



He, as a merchant, is allowed to store:
  • The primary account number (PAN);
  • The cardholder’s name;
  • The service code;
  • The card’s expiration date.

He is NOT allowed (per the Payment Card Industry Security Standards Council (PCI SSC):

Based on the info you gave so far, I highly recommend anyone who used a credit or debit card report this breach to their issuing company. As mentioned above, they can face serious penalties by doing this, including an audit by the FCC if it's egregious.
Per our PCI standards we can't store card numbers in plain text. They must be encrypted, and we have to have both limits on access in the database and access audits. This may be just our PCI compliance team being extra, but I doubt it.
 
Last edited:

Dannyalcatraz

Schmoderator
Staff member
Supporter
Based on the info you gave so far, I highly recommend anyone who used a credit or debit card report this breach to their issuing company. As mentioned above, they can face serious penalties by doing this, including an audit by the FTC if it's egregious.
This situation is monumentally stupid of them. If the FTC gets this one in their teeth, nuTSR is going to explode like the Death Star in the remastered versions of Star Wars.

I wonder: does the FTC has the power to issue a lifetime ban on handling/processing financial data? (Probably not, but one can hope.)
 
Last edited:

Sacrosanct

Legend
This situation is monumentally stupid of them. If the FCC gets this one in their teeth, nuTSR is going to explode like the Death Star in the remastered versions of Star Wars.

I wonder: does the FCC has the power to issue a lifetime ban on handling/processing financial data? (Probably not, but one can hope.)
It's FTC, not FCC. Sorry, I corrected it. Not much the FCC will do lol.
 


Related Articles

Remove ads

Remove ads

Top