NuTSR Financial Data Breach

The ongoing saga of “TSR3” continues as Justin LaNasa, owner of “TSR LLC”, allegedly stores and has emailed to others a spreadsheet containing customer financial information stored without any form of encoding or encryption.

In a video released by Don Semora of Wizard Tower Games, Semora claims Justin LaNasa emailed him a spreadsheet in May 2022 that included financial information from customers and business partners including full names, email addresses, home addresses, phone numbers, and even credit card numbers, all stored in plain text with no encoding or encryption. This includes customers of TSR or Dungeon Hobby Shop’s webstores purchasing products including Cult of Abaddon, Dungeon Crawl: The Board Game, TSR Dice, and others.

​

Screenshots of the spreadsheet (with private information redacted) show up in the video starting at the nine minute mark.

Wizard Tower Games also commented in the EN World thread “The Full & Glorious History of NuTSR” offering to confirm if anyone’s personal information was part of the spreadsheet he received. According to David Flor, transactions with the companies are processed under the name “Port City Kava”, an oxygen bar and vape/ecig store run by Justin LaNasa in North Carolina.

For those unfamiliar with the Saga of the TSR Trademark, EN World has a timeline of events with links to more information going back to the start in June of 2021 and, at the time of writing, updated through July 22, 2022.

The video from Semora is the most recent entry in a back-and-forth between himself and LaNasa following a Twitter post from Wizard Tower Games on August 29 confirming the company received two subpoenas related to the lawsuit with Wizards of the Coast. Michael K. Hovermale, former employee of TSR LLC, confirmed he also received a subpoena related to the lawsuit and confirmed in a post on EN World that he retained all information from his time working for LaNasa and informed LaNasa of this in June of 2022. In a video titled “OPEN LETTER LANASA” posted on September 1, Don Semora says he received a text message from LaNasa accusing Semora and Hovermale of “photoshopping documents”. The video consists of Semora posting screenshots of documents he claims were sent to him from LaNasa. In response, LaNasa claimed the documents in the video were Photoshopped by posting his own screenshots and calling Semora a "liar" on social media including in the title of a channel on the TSR Discord server, according to a screenshot from the private server posted by Kim Wincen. Semora responded with the video posted earlier today containing the spreadsheet along with other screenshots.

The trial between TSR LLC, the Dungeon Hobby Shop Museum LLC, and Justin LaNasa v. Wizards of the Coast is scheduled for a jury trial in October 2023.

 

[Abstruse]

This situation is monumentally stupid of them. If the FCC gets this one in their teeth, nuTSR is going to explode like the Death Star in the remastered versions of Star Wars.

I wonder: does the FCC has the power to issue a lifetime ban on handling/processing financial data? (Probably not, but one can hope.)

FTC (Federal Trade Commission) handles this. And while I don't believe the punishments include bans from handling financial information (it's why I didn't bring up the consequences in the article - I just don't know enough for sure about the specifics involved), it can include fines and other punishments if the breach is due to negligence. The credit card companies themselves are more likely to take direct action because they really don't like having to deal with the refunds involved in the case of fraud. The general rule of life is you can skirt whatever laws and regulations you want to so long as you do not #&%@ with a corporation's money.

 

[Abstruse]

Side note: This is the process TSR, LLC. and Dungeon Hobby Shop Museum, LLC. should be following: Data Breach Response: A Guide for Business

 

[Dannyalcatraz]

The credit card companies themselves are more likely to take direct action because they really don't like having to deal with the refunds involved in the case of fraud.

True. And while it may exist, I doubt they have a blackish either, based on my past experiences.

 

[DLIMedia]

Side note: This is the process TSR, LLC. and Dungeon Hobby Shop Museum, LLC. should be following: Data Breach Response: A Guide for Business

It's worth mentioning that the charges in question are actually not from "TSR LLC"... Justin's been using the merchant account of his oxygen bar in Wilmington, "Port City Kava", to handle all the card processing. It's also what appears as the account owner if you use PayPal.

For the record, "Port City Kava" has been administratively dissolved since 2020...

...so I'm not sure how legal him doing this actually is. Pretty sure the bank and card providers would be none too thrilled.

 

[Umbran]

As mentioned above, they can face serious penalties by doing this, including an audit by the FTC if it's egregious.

Are these people doing enough business for anything they do to be "egregious" in the eyes of a Federal agency?

 

[Abstruse]

It's worth mentioning that the charges in question are actually not from "TSR LLC"... Justin's been using the merchant account of his oxygen bar in Wilmington, "Port City Kava", to handle all the card processing. It's also what appears as the account owner if you use PayPal.

For the record, "Port City Kava" has been administratively dissolved since 2020...

View attachment 260336

View attachment 260337

...so I'm not sure how legal him doing this actually is. Pretty sure the bank and card providers would be none too thrilled.

It's not unheard of. I know a lot of connected companies that use one of the companies as the designated "payment processor". I'm not sure how the organization works for something like that and whether or not LaNasa set it up properly. But considering his approach to data security, we can take a guess.

As far as the store, if it's still open then it's likely just converted from an LLC to a sole proprietorship. Which is going to be a problem not only in the WotC lawsuit since they've named LaNasa personally in their countersuit, but also if the FTC decides to levy fines.

 

[Shakeshift]

In my own experience, multiple people reporting and complaining about the problem REALLY seems to get the FTC and the credit card companies to take quick and painful action against the perpetrator. There's nothing like getting all your financial infrastructure yanked out from under your feet in a few hours.
I suggest everyone write in and complain about Justin Lanasa and his various holdings. They'll shut him down quickly if there are enough people who complain loudly enough. Sticking him in his financials is where it always does the most good. Nobody likes to be told by a bank that they're a high-risk threat, and their rights are being dialed back accordingly. Plus Justin's swagger mostly comes from having his money, which is as good of a way to deflate his ego as any.

 

[Abstruse]

In my own experience, multiple people reporting and complaining about the problem REALLY seems to get the FTC and the credit card companies to take quick and painful action against the perpetrator. There's nothing like getting all your financial infrastructure yanked out from under your feet in a few hours.
I suggest everyone write in and complain about Justin Lanasa and his various holdings. They'll shut him down quickly if there are enough people who complain loudly enough. Sticking him in his financials is where it always does the most good. Nobody likes to be told by a bank that they're a high-risk threat, and their rights are being dialed back accordingly.

I would advise making sure you have standing to report to the FTC before filing a report. If you've made a purchase from TSR or DHSM (whether you didn't know their reputation at the time or out of morbid curiosity or just to see if they actually had products to sell), you definitely should report your concerns to the FTC. If not, I'd recommend at the very least checking their FAQ before filing a report. I'm not sure if there are any penalties involved in filing reports if you're not directly or at least potentially affected by a data breach, so make sure that you can file a report before doing so.

 

[Sacrosanct]

I suggest everyone write in and complain about Justin Lanasa and his various holdings.

For the record, I don't think we should be telling anyone to engage in activities that would negatively hurt him if they aren't directly an aggrieved party. And even then, the only advice we should give is to follow standard procedure.

The only people that should be doing anything with this are those who potentially have their personal data compromised, and then it should be registered through the various companies that own the credit/debit cards that were used.

By the book folks. Anything else helps his case of being a victim, and may in fact get you in trouble.

 

[Shakeshift]

I would advise making sure you have standing to report to the FTC before filing a report. If you've made a purchase from TSR or DHSM (whether you didn't know their reputation at the time or out of morbid curiosity or just to see if they actually had products to sell), you definitely should report your concerns to the FTC. If not, I'd recommend at the very least checking their FAQ before filing a report. I'm not sure if there are any penalties involved in filing reports if you're not directly or at least potentially affected by a data breach, so make sure that you can file a report before doing so.

Of course. I would never suggest filing out of spite, but if your data is out there make sure that you report it ASAP.