Sign in with
Sign up | Sign in

Blizzard Hacked, Emails and Secret Question Answers Stolen

By - Source: Blizzard | B 36 comments

Blizzard investigates the severity of a security breach that occurred earlier this week.

Earlier today, Blizzard announced some unsettling news for Battle.net users. The company's security team found evidence this week that a security breach took place.

While the team was able to quickly close off access and has already contacted law enforcement and security expert agencies for assistance, the company states that some information was compromised during the breach.

At this time, the company hasn't found any evidence that sensitive financial information such as addresses, names or credit cards have been compromised, but the investigation is ongoing.

As for what was compromised, the company states:

Some data was illegally accessed, including a list of email addresses for global Battle.net users, outside of China. For players on North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) the answer to the personal security question, and information relating to Mobile and Dial-In Authenticators were also accessed. Based on what we currently know, this information alone is NOT enough for anyone to gain access to Battle.net accounts.

In addition to the emails and secret question answers, Blizzard states that cryptographically scrambled Battle.net passwords were also taken. But the company says Battle.net passwords feature an additional layer of security using Secure Remote Password protocol (SRP), making it difficult for hackers to extract the actual passwords without having to decipher each password individually.

Regardless, it is still suggested that players on North American servers change their passwords on Battle.net and any other accounts with the same password. As the investigation continues, Blizzard will prompt its North American players to change their secret questions and answers through an automated process.

For more information on the hacking, read Blizzard's official statement here, along with the additional FAQ page they have on the breach.

Discuss
Display all 36 comments.
This thread is closed for comments
Top Comments
  • 24 Hide
    rantoc , August 10, 2012 2:45 AM
    I feel even more sorry for the people who just wanted to play Diablo 3 in single-player and due to the forced online play now had their email addresses ect in the wrong hands. I really hope that nothing more was leaked. The cloud is secure enough! /end sarcasm!
  • 19 Hide
    schnitter , August 10, 2012 2:09 AM
    Oh wow, as if the e-mails "Your WoW account has been suspended, click this link to reactivate" weren't already rolling in (don't even play that game), now it will be worse.

    I only have Diablo III which I have not played in close to 2 months. They can keep it as I am done with Blizzard. Since Activision merged with Blizzard, they are as bad as EA.
  • 17 Hide
    wildkitten , August 10, 2012 2:50 AM
    Well, I wonder what all the blind fan kiddies who said Blizzard could never get hacked will say now.
Other Comments
  • 19 Hide
    schnitter , August 10, 2012 2:09 AM
    Oh wow, as if the e-mails "Your WoW account has been suspended, click this link to reactivate" weren't already rolling in (don't even play that game), now it will be worse.

    I only have Diablo III which I have not played in close to 2 months. They can keep it as I am done with Blizzard. Since Activision merged with Blizzard, they are as bad as EA.
  • 15 Hide
    tomfreak , August 10, 2012 2:12 AM
    It just prove that they are not putting enough effort on their online security.
  • -7 Hide
    nukemaster , August 10, 2012 2:19 AM
    Maybe if they would at least use CASE SENSITIVE passwords it may help.

    For real, if you have any blizzard game go try it. Case means nothing type a pass all cap/all small/or mixed it does not care at all.
  • 24 Hide
    rantoc , August 10, 2012 2:45 AM
    I feel even more sorry for the people who just wanted to play Diablo 3 in single-player and due to the forced online play now had their email addresses ect in the wrong hands. I really hope that nothing more was leaked. The cloud is secure enough! /end sarcasm!
  • 17 Hide
    wildkitten , August 10, 2012 2:50 AM
    Well, I wonder what all the blind fan kiddies who said Blizzard could never get hacked will say now.
  • 7 Hide
    rantoc , August 10, 2012 3:01 AM
    wildkittenWell, I wonder what all the blind fan kiddies who said Blizzard could never get hacked will say now.


    The same thing most cloud lovers do by continuing to calm the cloud is secure hack after hack, trying to find excuses for each while there is none other than denial of the risk it poses to collect all eggs in one spot. Sure its possible to make a system very hard to hack but in truth no system is completely unhackable and the more interesting information it contains the more likely it will attract the attacks of the really skilled people.
  • 7 Hide
    Pennanen , August 10, 2012 3:26 AM
    schnitterOh wow, as if the e-mails "Your WoW account has been suspended, click this link to reactivate" weren't already rolling in (don't even play that game), now it will be worse.I only have Diablo III which I have not played in close to 2 months. They can keep it as I am done with Blizzard. Since Activision merged with Blizzard, they are as bad as EA.


    Yeah, the hackers have to play world of casual pandacraft and diablo 3 if they get my account, thats enough punishment for hacking :D 
  • 0 Hide
    Kami3k , August 10, 2012 3:32 AM
    christarpMan i feel sorry for all these companies this is happening to. Blizzard, sony, linkedin, etc


    Why?

    Sony brought it on themselves. The exploit used was as basic as you can get when it comes to hacking.

    If they had good security they wouldn't be hacked as no one would go through that much trouble for no gain.
  • 6 Hide
    Afrospinach , August 10, 2012 3:34 AM
    nukemasterMaybe if they would at least use CASE SENSITIVE passwords it may help.For real, if you have any blizzard game go try it. Case means nothing type a pass all cap/all small/or mixed it does not care at all.


    Just tried it, apparently you never have. They are case sensitive.
  • -3 Hide
    aggroboy , August 10, 2012 3:47 AM
    rantocI feel even more sorry for the people who just wanted to play Diablo 3 in single-player and due to the forced online play now had their email addresses ect in the wrong hands. I really hope that nothing more was leaked. The cloud is secure enough! /end sarcasm!

    It's not like BNet is the only place which stored our personal details. There are FB, Amazon, PP, Newegg maybe, xlive/psn, steam, etc.

    Also it's been clear since long ago that D3 would be online-only, you are not forced to buy the game.
  • 0 Hide
    Nakal , August 10, 2012 3:47 AM
    At one time, they weren't but I think it changed in the last few years. there was a time I could mix cases on my password and it wouldn't care.
  • 5 Hide
    hotroderx , August 10, 2012 3:50 AM
    aggroboyIt's not like BNet is the only place which stored our personal details. There are FB, Amazon, PP, Newegg maybe, xlive/psn, steam, etc.Also it's been clear since long ago that D3 would be online-only, you are not forced to buy the game.


    World of Warcrafts Password is case sensitive
    Diablo 3's Password is Not case sensitive

    I know this from testing it my self back when D3 first launched. People where mighty upset you could not use symbols in your password and it was not case sensitive making it super easy to brute force.

    I really like to know why there is a difference between the two systems.
  • 1 Hide
    kinggremlin , August 10, 2012 4:18 AM
    Kami3kWhy?Sony brought it on themselves. The exploit used was as basic as you can get when it comes to hacking. If they had good security they wouldn't be hacked as no one would go through that much trouble for no gain.


    How difficult it was to get in isn't really relevant. They were still the victim of an illegal act. If someone accidently leaves their front door unlocked, that isn't justification for someone else to enter their house and rob them. Was leaving the door locked the owner's fault? Absolutely, but if someone really wanted to break into your house there is very little you could do stop them. A locked door will not stop a skilled thief. Same thing goes here, these companies may not have the most sophisticated security systems in place, but their is very little they can do to stop skilled hackers that are targetting them no matter what practical lengths they go through to secure their network.
  • 6 Hide
    A Bad Day , August 10, 2012 5:29 AM
    What? No information stored in plain text?
  • 6 Hide
    wildkitten , August 10, 2012 5:36 AM
    aggroboyAlso it's been clear since long ago that D3 would be online-only, you are not forced to buy the game.

    And all the fan kiddies assured everyone that Blizzard could never get hacked, that online only meant no duping and no exploits such as a class being able to be invulnerable.

    Well, all 3 has happened.

    Of course since Blizzard crippled the authentication system with the "feature" of not asking for the authenticator if the login server thinks your account is being logged in from the same IP adress which took possible hacking from the rare and difficult Man in the Middle Attack to the much easier IP spoofing, I'm not shocked because they have proven they are not all that concerned with security.
  • 1 Hide
    AznCracker , August 10, 2012 5:55 AM
    phew all i have is star craft II, have not played that in a while. Nothing worth stealing from me as I never bought anything directly from blizzard.
  • -3 Hide
    peroludiarom , August 10, 2012 6:02 AM
    HotRoderxWorld of Warcrafts Password is case sensitive Diablo 3's Password is Not case sensitiveI know this from testing it my self back when D3 first launched. People where mighty upset you could not use symbols in your password and it was not case sensitive making it super easy to brute force. I really like to know why there is a difference between the two systems.

    A Bad DayWhat? No information stored in plain text?


    Man, stop talking bull***s please. Diablo 3 and WOW uses the same password from Battle.net, which is CASE SENSITIVE.
  • 2 Hide
    hotroderx , August 10, 2012 6:33 AM
    peroludiaromMan, stop talking bull***s please. Diablo 3 and WOW uses the same password from Battle.net, which is CASE SENSITIVE.

    I tested it my self obviously ur either a troll our ignorant they are the same password just in D3 its not case sensitve which is scary.
Display more comments