Researchers at Drexel University and Dakota State University have apparently figured out a way to lift someone’s personal information from a refurbished Xbox. While a resold Xbox 360 should have its hard drive wiped, researchers from both universities told Kotaku that they were able to purchase a refurbished model from an authorized retailer and then gain access to the personal information of its previous owners by using a “basic modding tool.” This information includes credit card information as well as identity verification details such as names and addresses.
GameSpot recently followed up on this claim with Microsoft. Jim Alkove, general manager of security for Microsoft Gaming, said that it is highly unlikely that these claims are true.
"Xbox is not designed to store credit card data locally on the console, and as such seems unlikely credit card data was recovered by the method described," he said. "Additionally, when Microsoft refurbishes used consoles we have processes in place to wipe the local hard drives of any other user data. We can assure Xbox owners we take the privacy and security of their personal data very seriously.
“We are conducting a thorough investigation into the researchers' claims. We have requested information that will allow us to investigate the console in question and have still not received the information needed to replicate the researchers' claims."
By Angelo M. D'Argenio