Report: Used Xbox 360 consoles still have credit card info [Update]

If you own an old Xbox 360 console and want to give it to a friend or turn it in for cash or credit at your local video game store, you may want to think twice before doing so. Kotaku reports that according to a research team at Drexel University, the console could still have your credit card information stored inside, even if you restore the console back to its original factory conditions.

The research team claims they bought a refurbished Xbox 360 console in 2011 and then used a basic modding software tool to access the console's folders. Eventually, the team was able to gain access to the credit card information inside the console, presumably belonging to an earlier owner of the console.

According to researcher Ashley Podhradsky, experienced Xbox 360 modders could easily be able to do the same thing as the research team, saying, "Anyone can freely download a lot of this software, essentially pick up a discarded game console, and have someone's identity." Podhradsky recommends that if you do give up your own Xbox 360 console, it's best to take out the console's hard drive and attach it to a computer. Users can then download and use any number of PC sanitation programs to wipe out the hard drive completely.

As of now, Microsoft has yet to respond to the research team's claims.

Update - In a statement sent to Joystiq, Microsoft says it is looking into the matter but added, "Xbox is not designed to store credit card data locally on the console, and as such seems unlikely credit card data was recovered by the method described."

Report a problem with article
Previous Story

Nokia launches Lumia Challenge campaign

Next Story

Report: Microsoft won't add Start button for Windows 8

20 Comments

Commenting is disabled on this article.

These "researchers" are spouting total bull. First, credit card information is not stored on the console locally or on the profile (your actual account file). Second, when you restore an Xbox 360 to factory settings you are restoring the console NOT the hard drive. You must format the hard drive on it's own to erase any profiles, game saves, or anything you've downloaded to the hard drive for that matter.

I cannot believe that these "researchers" would even claim this. For those curious on the details of their research, here you go: They connected the hard drive to their computer either using a Microsoft provided transfer cable, a Datel transfer cable, or took it apart and connected it directly to their computer. After which they open any of the readily available free drive explorers designed to read the Xbox 360's hard drive ... which have existed since 2005 btw. They then went and extracted a user's profile (read: account) and created bull **** claims that they have the users credit card information. NO! While they may have the profile and can easily transfer the profile to another Xbox there would be no difference in doing this and loading up a used Xbox 360 with a left over profile from a previous user and connect to Xbox LIVE.

Planning on actually selling an older 360 this weekend, I plugged the 20gb hdd into the transfer cable we have, hooked it up to my laptop and then downloaded and ran "Hard Disk Low Level Format Tool" on it.

Not sure how it works in other places in the world, but here in Canada credit cards are usless without certain things. If paying in person, Photo ID is required, and if purchasing on line, the cvv number (as well as expiry date) is required. Feel bad for counties that this can happen in.

rippleman said,
Not sure how it works in other places in the world, but here in Canada credit cards are usless without certain things. If paying in person, Photo ID is required, and if purchasing on line, the cvv number (as well as expiry date) is required. Feel bad for counties that this can happen in.

Except you enter CVV as a part of the card registration for 1 click purchasing in the future.

rippleman said,
Not sure how it works in other places in the world, but here in Canada credit cards are usless without certain things. If paying in person, Photo ID is required, and if purchasing on line, the cvv number (as well as expiry date) is required. Feel bad for counties that this can happen in.

I never got ask for my ID, and I always use my credit card to pay, never using bank or cash, only credits. Yes, I live in canada

just have wipe it... NOT a reinstall but an actaul 000000 wipe.

Skyfrog said,
Just like with selling a laptop, when you sell an Xbox you keep the hard drive.

Skyfrog said,
Just like with selling a laptop, when you sell an Xbox you keep the hard drive.

Thing is, it's not in the harddrive, it's in the console memory. Don't forget the xbox 360 work without a hard drive. The data is stored into a folder on the system memory, not the hard drive. So keeping your hard drive will solve nothing

I don't get why people even put their credit card numbers into a device like that in the first place. Just buy MS points at the store. I have yet to come across anything I couldn't buy using MS points though I may be missing something?

ILikeTobacco said,
I don't get why people even put their credit card numbers into a device like that in the first place. Just buy MS points at the store. I have yet to come across anything I couldn't buy using MS points though I may be missing something?

Right, and some people use the console and their CC to buy MS points, not everyone cares to do that on the website.

ILikeTobacco said,
I don't get why people even put their credit card numbers into a device like that in the first place. Just buy MS points at the store. I have yet to come across anything I couldn't buy using MS points though I may be missing something?

Ease of access thats all. I don't want to have to go to the store every time I want to buy a game or some random market item.

xXgreatestever said,

Ease of access thats all. I don't want to have to go to the store every time I want to buy a game or some random market item.

Its just part of my monthly errands. Every time I go to the mall I make a stop at Gamestop if my account is running low.

Frazell Thomas said,
Insane. I guess restoring defaults doesn't actually result in a full wipe of the drives as it should

I'll bet it will now! Unreal.

Frazell Thomas said,
Insane. I guess restoring defaults doesn't actually result in a full wipe of the drives as it should
maybe it just does a simple format. formats don't remove data from my understanding, they just remove the "shortcuts" that point to where the data lives. Thats why programs like Killdisk, etc exist - they wipe drives completely clean.