This is according to Jim Alkove, general manage of security for Microsoft’s game business, who stated:
“Xbox is not designed to store credit card data locally on the console, and as such seems unlikely credit card data was recovered by the method described,” he said. “Additionally, when Microsoft refurbishes used consoles we have processes in place to wipe the local hard drives of any other user data. We can assure Xbox owners we take the privacy and security of their personal data very seriously.
In any case, Microsoft is currently looking into the issue but there is no word yet on how they might address the problem if the researchers’ claims have been proven to be correct.