That might have spurred some people to sign up for HIBP notifications, since Hunt told IT Pro that a “high” number – 8,110 HIBP subscribers – received CD Projekt Red forum breach alerts.īut that’s not all, as nearly 1.3 million XBOX 360 ISO forum accounts and another 1.3 million PSP ISO forum accounts were exposed back in 2015. When 5,915,013 accounts were exposed on Nexus Mods, the news came out in December 2015 when the actual compromised database was from July 2013. The company has only now decided to start notifying affected users via email about the March 2016 breach. Please note there is a difference in how the game developer and HIBP said the passwords were stored HIBP said salted SHA1 passwords were exposed. This means your old passwords were secured and not directly accessible by anyone. It is our understanding that the obsolete forum database contained usernames, email addresses and salted MD5 passwords (MD5 is an encryption algorithm we used to encrypt your data). The forum engine has also been upgraded since then to the newest and most secure version, fixing the exploit that allowed said access. Yesterday after people who signed up to receive HIBP notifications started receiving emails about the breach, CD Projekt Red added:Īt the time of the event, the database was not in active use, as forum members had been asked to create better-secured GOG.com accounts almost a year earlier. However, we strongly encourage every user to change their password as a precautionary measure.” The company did post an “ unauthorized access” notification on its site back in December on The Witcher Series forum, Gwent news and Cyberpunk 2077, but it likely flew under the radar of thousands of affected users.Īccording to the game developer, the compromised accounts were from “the now-obsolete forum database.” The unauthorized access occurred “sometime in March 2016.” In December, forum users were told, “If any passwords had been downloaded, they would have also been encrypted. The hack of their forum led to the exposure of almost 1.9 million accounts along with usernames, email addresses and salted SHA1 passwords.Ĭompromised data: Email addresses, Passwords, Usernames In March 2016, Polish game developer CD Projekt RED suffered a data breach. Security researcher Troy Hunt wrote on Have I Been Pwned,
0 kommentar(er)
