NuTSR Financial Data Breach

The ongoing saga of “TSR3” continues as Justin LaNasa, owner of “TSR LLC”, allegedly stores and has emailed to others a spreadsheet containing customer financial information stored without any form of encoding or encryption.

tsr3.jpg

In a video released by Don Semora of Wizard Tower Games, Semora claims Justin LaNasa emailed him a spreadsheet in May 2022 that included financial information from customers and business partners including full names, email addresses, home addresses, phone numbers, and even credit card numbers, all stored in plain text with no encoding or encryption. This includes customers of TSR or Dungeon Hobby Shop’s webstores purchasing products including Cult of Abaddon, Dungeon Crawl: The Board Game, TSR Dice, and others.


Screenshots of the spreadsheet (with private information redacted) show up in the video starting at the nine minute mark.

Wizard Tower Games also commented in the EN World thread “The Full & Glorious History of NuTSR” offering to confirm if anyone’s personal information was part of the spreadsheet he received. According to David Flor, transactions with the companies are processed under the name “Port City Kava”, an oxygen bar and vape/ecig store run by Justin LaNasa in North Carolina.

For those unfamiliar with the Saga of the TSR Trademark, EN World has a timeline of events with links to more information going back to the start in June of 2021 and, at the time of writing, updated through July 22, 2022.

The video from Semora is the most recent entry in a back-and-forth between himself and LaNasa following a Twitter post from Wizard Tower Games on August 29 confirming the company received two subpoenas related to the lawsuit with Wizards of the Coast. Michael K. Hovermale, former employee of TSR LLC, confirmed he also received a subpoena related to the lawsuit and confirmed in a post on EN World that he retained all information from his time working for LaNasa and informed LaNasa of this in June of 2022. In a video titled “OPEN LETTER LANASA” posted on September 1, Don Semora says he received a text message from LaNasa accusing Semora and Hovermale of “photoshopping documents”. The video consists of Semora posting screenshots of documents he claims were sent to him from LaNasa. In response, LaNasa claimed the documents in the video were Photoshopped by posting his own screenshots and calling Semora a "liar" on social media including in the title of a channel on the TSR Discord server, according to a screenshot from the private server posted by Kim Wincen. Semora responded with the video posted earlier today containing the spreadsheet along with other screenshots.

The trial between TSR LLC, the Dungeon Hobby Shop Museum LLC, and Justin LaNasa v. Wizards of the Coast is scheduled for a jury trial in October 2023.
 

log in or register to remove this ad

Darryl Mott

Darryl Mott

TheSword

Legend
Actually, a "personal data breach" under the GDPR means a "breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed".

But regardless, the GDPR only applies in the EU, not the US. (Unless the US also has one that I've never heard of?)
A breach of security doesn’t just mean a breach of IT system security though. If someone sends an email to a group and inadvertently shares the email address of people that haven’t given them permission, that is a data protection breach.

It also does apply outside the EU where it affects EU citizens, irrespective of where the person controlling the data is based. It’s the reason so many sites had to update their terms when it was released.
 

log in or register to remove this ad

AncientPenguin

Social Distancing Expert™
If the same payment processor is spread across those other businesses, it's wholly within the realm of possibility that they'll drop him like a hot rock.

Additionally, a lot of other processors may not onboard him because of the lack of PCI compliance. That can lead to going with far riskier entities to process CC data with higher percentages and other concerns - all of which lead to that whole 'death of a thousand cuts'
I also want to mention the following -

If any customers that are impacted are in places like the EU or in California where there's GDPR and CCPA, respectively, that's some important stuff. These two regulatory frameworks are going to add another level of complexity to the mountain of trouble that's coming Justin's way.
 

AncientPenguin

Social Distancing Expert™
A breach of security doesn’t just mean a breach of IT system security though. If someone sends an email to a group and inadvertently shares the email address of people that haven’t given them permission, that is a data protection breach.

It also does apply outside the EU where it affects EU citizens, irrespective of where the person controlling the data is based. It’s the reason so many sites had to update their terms when it was released.
100% this.
 


CleverNickName

Limit Break Dancing
One screenshot from a text conversation with LaNasa indicates that his goal was to squat the trademark and get Wizards of the Coast to pay him $100 million for it (not kidding, he said he expected that much). It's led to speculation that pretty much everything else he's been doing in terms of social media and public relations has been for the sole purpose of dragging the TSR name through the mud to force WotC to pay him to go away.

As soon as the countersuit was filed, that should have been an indication that's not going to happen because they are going to take him to the cleaners. And since he's named personally in the countersuit, he doesn't have the legal shield of the LLCs to protect him.
He seriously expected a hundred million dollars for the trademark? And his acting-out on social media was all an attempt to embarrass Wizards of the Coast so badly that they would pay him to go away?

My grandma would tell me not to judge anyone until I've walked a mile in their shoes, but I don't think she had these shoes in mind.
1662496821116.png
 

Faolyn

(she/her)
He seriously expected a hundred million dollars for the trademark? And his acting-out on social media was all an attempt to embarrass Wizards of the Coast so badly that they would pay him to go away?
Wasn't there a guy who bought StarWars.com or MayTheForceBeWIthYou.com and thought he could sell it to Lucas for a zillion dollars, but just got sued by them?
 




Abstruse

Legend
He seriously expected a hundred million dollars for the trademark? And his acting-out on social media was all an attempt to embarrass Wizards of the Coast so badly that they would pay him to go away?

My grandma would tell me not to judge anyone until I've walked a mile in their shoes, but I don't think she had these shoes in mind.
View attachment 260552
I can't speak to how serious the $100 million amount was, but it was something he said in reference to selling the trademark to WotC. The context was bragging about how he was going to get a big payout for this. And I want to stress that him posting inane racist/sexist/homophobic/transphobic/ableist nonsense on the social media accounts to ruin the TSR brand is pure speculation. There's no evidence I'm aware of at this time to point to any particular motivation. And to me at least, it doesn't matter much why he's doing it other than academic curiosity. It doesn't matter the reasons as the harm being done is real either way. "Ironic racism" is still racism.
 

DLIMedia

David Flor, Darklight Interactive
I can't speak to how serious the $100 million amount was, but it was something he said in reference to selling the trademark to WotC. The context was bragging about how he was going to get a big payout for this. And I want to stress that him posting inane racist/sexist/homophobic/transphobic/ableist nonsense on the social media accounts to ruin the TSR brand is pure speculation. There's no evidence I'm aware of at this time to point to any particular motivation. And to me at least, it doesn't matter much why he's doing it other than academic curiosity. It doesn't matter the reasons as the harm being done is real either way. "Ironic racism" is still racism.
The $100M number may have been an exaggeration, but multiple sources have told me he expected to get at least six figures.
 




Michael Linke

Adventurer
If the same payment processor is spread across those other businesses, it's wholly within the realm of possibility that they'll drop him like a hot rock.

Additionally, a lot of other processors may not onboard him because of the lack of PCI compliance. That can lead to going with far riskier entities to process CC data with higher percentages and other concerns - all of which lead to that whole 'death of a thousand cuts'
I think using the payment processor for multiple businesses is ok, but he's crossing state lines if he uses that processor in North Carolina and Wisconsin. I'm pretty sure that's tricky unless he's very carefully accounting revenue for the two businesses so they can be taxed by the appropriate states. But it seems all his businesses share one payment processing account, and he exposed data for that one account. So if they suspend his account, all his businesses become "cash only".
 

Sacrosanct

Legend
Publisher
They don't own "TSR", I think they own the trademark rights to a specific logo.
That's what I'm saying; we'll soon find out they don't own that either. WoTC has been selling material with that logo the entire time, so when Justin answered "no" to the question on the application if anyone else was currently using the logo, he lied. He registered for that logo under fraudulent circumstances. I am 95% certain that will be the ruling when this is said and done.
 

After reading all this mess, I'd hate to give these folks 1 red cent but... Can't someone "buy" TSR from these jokers and do something constructive with it? It's a shame to let a mark with its weight and legacy to be trapped by people like this.
Fundamentally, what I expect to see happen is that WotC will steamroll these child-cartoon-villains, and will henceforth rabidly protect the TSR name, while at the same time not making it a core product people will constantly google (dragging up this embarrassing episode in perpetuity). I don't know what that will look like, but the cheeky part of my brain imagines a yearly publication that they sell exclusively in a store in Hasbro HQ (past a point where you have to badge-in to access) for $1.00 that is nothing but a list of other words and phrases they want to keep legal control over (such as Star Frontiers). Or something of that nature -- nothing vital to a business interest but which protects them from future headaches like this.
 

Abstruse

Legend
They don't own "TSR", I think they own the trademark rights to a specific logo.
Fundamentally, what I expect to see happen is that WotC will steamroll these child-cartoon-villains, and will henceforth rabidly protect the TSR name, while at the same time not making it a core product people will constantly google (dragging up this embarrassing episode in perpetuity). I don't know what that will look like, but the cheeky part of my brain imagines a yearly publication that they sell exclusively in a store in Hasbro HQ (past a point where you have to badge-in to access) for $1.00 that is nothing but a list of other words and phrases they want to keep legal control over (such as Star Frontiers). Or something of that nature -- nothing vital to a business interest but which protects them from future headaches like this.
I think there might be some misunderstandings about what's going on.

Justin LaNasa registered the name "TSR" along with some associated logos as trademarks for his company, TSR LLC, along with a registration for the name "Star Frontiers". He does claim ownership of the name "TSR" as he attempted to get Jayson Elliot to license the name back from him for his company also called TSR (now called Solarian Games).

Wizards of the Coast currently uses the trademarks "TSR", "Star Frontiers", and many others along with the graphic logos that Justin LaNasa registered as they sell reprints of classic TSR-era modules and the original Star Frontiers game on DMs Guild and/or DriveThruRPG. Star Frontiers in particular came up when Evil Hat games also attempted to register the trademark but, after talking with Wizards of the Coast, backed down. It was then that Wizards put the original Star Frontiers for sale on DMs Guild.

When LaNasa filed for the trademarks, Wizards of the Coast filed an objection to their registration before it was finalized. LaNasa sued Wizards of the Coast for the right to use the trademarks, then Wizards of the Coast counter-sued for LaNasa violating their trademarks. The trial will determine who owns the trademarks and how much (if any) damages the other party will have to pay.

It should be noted that, under United States law, you do not need to register a trademark for it to be legally protected, but registering the trademark does give you more legal protections than if you do not. Just because Wizards of the Coast allowed the registration to lapse does not mean that they "lost" the trademark as other things have to occur for that to happen. And that's what the court will decide.
 


Rabulias

the Incomparably Shrewd and Clever
How many times can you shoot yourself in your own foot before you run out of feet? :oops:
So in this analogy, he will always have another foot to shoot.
NuTSR is kind of like some bizarre variant hydra with the following traits:

Shoot Foot. As a bonus action, the NuTSR hydra can shoot one of its own feet.

Multiple Feet. The NuTSR hydra has multiple feet. Each turn it needs to roll an Integrity saving throw to avoid tripping over its own feet, landing prone on a failure. If the NuTSR hydra has any active sock puppets (see below), this saving throw is at disadvantage.

Regrow Feet. At the end of its turn, it grows two feet for each foot that was shot off since its last turn. If the NuTSR hydra is subjected to the social media silence spell, this trait does not function.

Sock Puppet. As an action, the NuTSR hydra can create a sock puppet for each active foot that it has.
 

Related Articles

Visit Our Sponsor

An Advertisement

Advertisement4

Top