The private information of over 2,000 E3 2019 attendees who had a media badge has leaked online. The owners of E3, the Entertainment Software Association, had a page on their website linking to a spreadsheet file with the personal information of each journalist, YouTuber, streamer, developer, etc. It listed their full name, phone number, address, and other information as well.
The accidental leak of information by the ESA was first spotted by Sophia Narwitz. Narwitz contacted the ESA by phone and email without a response and shortly after, the page with the file was taken down. This was done before she did her report on the topic.
A brief statement on the incident is circulating around and was provided to TechRaptor as well,
“ESA was made aware of a website vulnerability that led to the contact list of registered journalists attending E3 being made public. Once notified, we immediately took steps to protect that data and shut down the site, which is no longer available. We regret this occurrence and have put measures in place to ensure it will not occur again.”
A list including those with media badges is used by the ESA for helping coordinate with companies at E3 in getting their information to the media. This includes anything from press releases to setting up meetings. It’s unknown why this information was easily available and has risen concerns over a potential General Data Protection Regulation Breach. Also known by its acronym, GDPR. Additionally, at this time the ESA has not contacted the people who were on the list about the data being leaked.
According to Narwitz, a group of content creators and companies are preparing for a lawsuit regarding the incident. It’s unknown who specifically, but the leak has affected both individuals and companies inside and outside the game industry. She expects more information on the lawsuit to be public on either Monday or Tuesday according to the below tweet.
This story just got juicer. Another source has reached out and I’ve been told there’s a group of content creators already gearing up for a lawsuit, this will be put forth on Mon or Tues, and on top of that, a few big names companies are following suit.
— Sophia Narwitz (@SophNar0747) August 3, 2019
As of the time reporting this story, several people on the list have already been targeted by harassers who were able to acquire access to the data.