CORE Cashless data breach: what happened and what to do

Attackers got into CORE Cashless's systems on January 29, 2022 and captured details typed into the online payment portals of about 45 of its clients. The exposed data included names, billing addresses and payment card information, and in some cases email addresses and phone numbers.

View all 13,177 breaches

Breach date: 29 Jan 2022
Data exposed: Names, Physical addresses, Credit cards, Email addresses, Phone numbers
Last updated: 30 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

CORE Cashless provides cashless payment systems for venues such as stadiums and family entertainment centers. According to its notice letters to state attorneys general, an unauthorized person got into its environment on January 29, 2022. The company says it learned of the compromise around July 28, 2022, and contained it by July 31.

A preliminary filing with the Maine Attorney General describes the method: the attacker used a SQL injection to reactivate a deactivated administrator account, installed backdoor tools, and placed skimmers that captured text entered into clients' online payment portals. The filing says the incident appeared limited to customers who paid through the web portals of about 45 CORE clients.

Sources checked: mass.gov, maine.gov, oag.ca.gov

Last verified against the official page: 30 Oct 2026

How we research this Report an error

What was exposed

The notice says the data may have included names, addresses and payment card information. The Maine filing adds card holder names, billing addresses, email addresses and phone numbers. No Social Security numbers are listed.

Card details let criminals make purchases or sell the card. Names plus email addresses and phone numbers also make phishing and text scams more believable, especially ones that mention a card problem.

What CORE did

The letters say CORE offered affected people credit monitoring and identity theft services. The length of the offer differs between versions of the letter, so check the one you received.

What it means for you

If you paid online through a venue that uses CORE, check the card you used. Look at your statements back to early 2022 and ask your card issuer for a new card number if anything looks off.

What to do if you were in it

1

Check your card statements

Look for charges you don't recognize on any card you used at an online payment portal in 2022. Report them to your card issuer right away.
2

Ask for a new card number

If your card was exposed, your issuer can replace it. A new number makes the old details useless.
3

Be wary of messages about your card

Expect emails and texts that mention the breach or a card problem. Don't click links in them; contact your bank using the number on your card.
4

Consider a credit freeze

A freeze is free and stops new accounts being opened in your name. The FTC explains how to place one at Equifax, Experian and TransUnion.
5

Report misuse

If someone uses your details, report it at IdentityTheft.gov. To see which other breaches include your email or phone, run a free Serus scan.

Official filings

California Attorney General , filed 13 Sept 2022

Timeline

29 Jan 2022
The breach happened
13 Sept 2022
Reported to the California Attorney General

Frequently asked

Was I affected by the CORE Cashless breach?

Only people who paid by card through the online portals of certain CORE clients were involved. If you got a notice letter, you were. If you didn't, check the card you used at venues in 2022.

What data was exposed?

Names, billing addresses and payment card information, and in some cases email addresses and phone numbers, according to the company's filings.

Should I change my password?

No password exposure is listed in the filings. Replacing the card is the step that matters here.