GAME.co.uk accounts hacked - money stolen

buffvam77

Unholyangel. A recorded letter will be my next step. Although when asked to send an email specifically by the guys who run Games twitter account and nothing being done with that even though they assure me it's been passed to Customer Services. I am unsure whether they will ever get round to reading my letter.

unholyangel

buffvam77 wrote: »

Unholyangel. A recorded letter will be my next step. Although when asked to send an email specifically by the guys who run Games twitter account and nothing being done with that even though they assure me it's been passed to Customer Services. I am unsure whether they will ever get round to reading my letter.

So have they blocked access for whoever had your account?

How do you know they used all your points and what they used them on if you cant log into your account?

buffvam77

unholyangel wrote: »

So have they blocked access for whoever had your account?

How do you know they used all your points and what they used them on if you cant log into your account?

No they have done nothing. The person who's hacked the account has blocked my access by changing the username (email address) on the account. I would have been none the wiser if I hadn't received an email from GAME.co.uk thanking me for updating my details.

I don't know if they've stolen any of my game points, that was the OP. I guess I'll find out when they find it urgent enough to take a look at my account.

unholyangel

Is there a Game store local to you thats still open at all?

If there is, may be worthwhile going in there, speaking to the manager and seeing if they can offer any help or if they have a contact number for CS that they can call them on to get their attention?

Gaspode

I've just had an email from game telling me that "It would appear that there has been some unauthorised access to your account" - I've changed my password and removed all the stored card details, but it looks as if this could be widespread - if you have an account with game, change your account password now!

arcon5

lovinituk wrote: »

To be fair I'm not surprised they are getting defensive. Everyone seems to be repeating the same questions over and over when it was quite clear from the OP - well I thought it was clear anyway.

And now arcon is making assumptions how the access was gained to account!

Gotta love this forum sometimes :undecided

And a fair assumption at that. Since op said:

As a side note, if you have a GAME account, I advise you to change your password ASAP.

Which would indicate to any reasonable person the person accessed the account using the password.

If this is the case, it would be more than likely (but not impossible of course) ops computer has been compromised than their servers hacked in to.

Which therefore leaves the ball in ops court to provide more information (which he may have already, but i'm only half way through reading all the replies).

unholyangel

arcon5 wrote: »

And a fair assumption at that. Since op said:

Which would indicate to any reasonable person the person accessed the account using the password.

If this is the case, it would be more than likely (but not impossible of course) ops computer has been compromised than their servers hacked in to.

Which therefore leaves the ball in ops court to provide more information (which he may have already, but i'm only half way through reading all the replies).

A agree with arcon.

AFAIK its standard for passwords to be encrypted, even from server admin. They can run it through software which will crack your password if its weak, but if you have a strong password then even that wont necessarily work.

Whether its true or not, GAME responded to the hacking threat saying they had investigated it and none of the details listed on the site were actually registered on their site.

I'm inclined to believe them since it would be insanely stupid of them to deny a hack when there genuinely was one as they would then be responsible for any additional losses on top of that through negligence. Where if they had admitted it and asked everyone to change their passwords/automatically reset everyones passwords, it would have been huge in mitigation as the thieves would have had little chance - if any - to actually profit from the details.

Some hackers just arent what they used to be. Now if it was anonymous, then you'd have to worry.

visidigi

unholyangel wrote: »

A agree with arcon.

AFAIK its standard for passwords to be encrypted, even from server admin. They can run it through software which will crack your password if its weak, but if you have a strong password then even that wont necessarily work.

Whether its true or not, GAME responded to the hacking threat saying they had investigated it and none of the details listed on the site were actually registered on their site.

I'm inclined to believe them since it would be insanely stupid of them to deny a hack when there genuinely was one as they would then be responsible for any additional losses on top of that through negligence. Where if they had admitted it and asked everyone to change their passwords/automatically reset everyones passwords, it would have been huge in mitigation as the thieves would have had little chance - if any - to actually profit from the details.

Some hackers just arent what they used to be. Now if it was anonymous, then you'd have to worry.

Then again...Tesco were recently in trouble and they email passwords as plain text...there's nothing standard...

arcon5

I think Unholy meant stored encrypted in their DB. Which is highly likely. In the case of Tesco emailing the password, although it is terrible practice to do so, the users email account would also need to be compromised for them to get access to your account using the emailed password.

I think if we looked at the number of cases where peoples accounts are 'hacked', whether it be GAME, eBay, PayPal, Amazon or whoever else, the vast number of cases would be down to the users computer being compromised in some way than it would be the companies database.

unholyangel

visidigi wrote: »

Then again...Tesco were recently in trouble and they email passwords as plain text...there's nothing standard...

Indeed, were stored encrypted but then when they asked for a reminder was decrypting it to send in plain format.

And while theyre not alone in it, its generally not the "norm".

Only time I've personally witnessed such a breach (website security) was when a website was hacked, they shut the site down and reset everyones passwords. A surprising number of users passwords were crackable.

Speaking to a few friends the other week, I was actually shocked at how easy their passwords are. Like so easy you could guess it with no software required.