Diablo 3 Account Hacked

You need an authenticator on a battle.net account. There is no way around that. Download the free version or buy the one blizzard sells at cost.

Blizzard should have done a better job at letting Diablo players know how to protect their account. WoW players are very well aware of the importance. Bundling an authenticator with every physical copy would have gone a long way in helping with these issues.
 
password and authenticator, it's like wearing two condoms for extra protection
 
Add me to the list..... Im on a fresh format of win7 and found my main character stripped. Fantastic. Going for the rollback.
 
Why do we never hear about any other company being hacked en masse? Activision fans wants to say it's keyloggers, viruses, brute force, whatever. But Blizzard is getting hacked on a Sony-level scale. What the hell is really going on?

At least Sony admitted they'd been hacked. Either Blizzard is oblivious or lying.


password and authenticator, it's like wearing two condoms for extra protection
Unless the condom makers put out a product with a bunch of holes in it!
 
In all my years of computing, Ive never ever gotten any of my accounts compromised..... Now blizzard says its not possible to do public game spoofing, so im not sure who to trust at this point.....

Im guessing im not the only one here on Hard thats in the same situation
 
Why do we never hear about any other company being hacked en masse? Activision fans wants to say it's keyloggers, viruses, brute force, whatever. But Blizzard is getting hacked on a Sony-level scale. What the hell is really going on?

At least Sony admitted they'd been hacked. Either Blizzard is oblivious or lying.



Unless the condom makers put out a product with a bunch of holes in it!

Pst condoms do have holes in them. You are just hoping they are smaller than the organism trying to gain access to your fun toy:p
 
Know why you hear about it more with blizzard than anyone else?

Because no one else has 10,000,000 people playing their games at any given time.

Here's blizzard's response thus far:

http://us.battle.net/d3/en/forum/topic/5568799806?page=5#84

I don't have all of the details in front of me at this moment so I won't make generalizations about how and why group play doesn't inherently make you less secure. But again, I've read detailed reports about the steps several talented and highly capable employees from numerous departments at Blizzard have taken to verify player account information has remained secure within our system.

There aren't a lot of details we can reasonably provide about our infrastructure and programming. That said, at some level we shouldn't have to. We have every obligation to protect your personal information. And, if that information were ever to become compromised, we'd have every obligation to let you know about it right away. It's why we keep saying account security is important to us. It's about much more than PR. It's about ethics, standards, and even legalities.

I say it saddens me personally because I want you to enjoy the game I'm enjoying. I know that if you're conscientious about system and account security -- and especially if you attach an authenticator to your account -- you should have nothing to worry about! You shouldn't hesitate to play with any of the millions of other people logged in right now and doing JUST THAT. :)
 
I think it's really sad that in this forum, specifically it being hardforum, there are users that you would think would be educated enough to realize that this is not a "Sony-level" hack on Blizzard's part. If you consider yourself technically savvy at all, then you would understand what is exactly going on here.

1) People are being dumb.
2) Those people are too prideful to admit they are being dumb.
3) It isn't a bad thing to say, "Maybe it is on my end." It may not have happened in other games you've played, but Blizzard games are notorious since WoW, to be the victim of heavy-handed techniques used by these people to break into accounts. I mean heck, there are dedicated groups out there purely trying to hack Blizzard accounts because popularity = money.
4) It will all work out in the end, and adding an authenticator is a cheap fix to this.

Blizzard is right, they would not be "lying" about this. There's way too much at risk to be doing that. It isn't some conspiracy. I really cannot believe this needs to even be posted here.

Edit: I'll put this in there: If it ends up being a huge breach, and hundreds of thousands of accounts were compromised where Blizzard communicates to us that there was a breach - I'll eat my words.
 
Last edited:
i noticed 3 new names show up on my recent players list after i got hacked: xererer, Romeisbak, Olarad
 
It's too bad it's not "illegal" to hack accounts, would be nice to have an international operation where law enforcement from different country investigate these hacks and legal action can take place.
 
I think it's really sad that in this forum, specifically it being hardforum, there are users that you would think would be educated enough to realize that this is not a "Sony-level" hack on Blizzard's part. If you consider yourself technically savvy at all, then you would understand what is exactly going on here.

1) People are being dumb.
2) Those people are too prideful to admit they are being dumb.
3) It isn't a bad thing to say, "Maybe it is on my end." It may not have happened in other games you've played, but Blizzard games are notorious since WoW, to be the victim of heavy-handed techniques used by these people to break into accounts. I mean heck, there are dedicated groups out there purely trying to hack Blizzard accounts because popularity = money.
4) It will all work out in the end, and adding an authenticator is a cheap fix to this.

Blizzard is right, they would not be "lying" about this. There's way too much at risk to be doing that. It isn't some conspiracy. I really cannot believe this needs to even be posted here.

Edit: I'll put this in there: If it ends up being a huge breach, and hundreds of thousands of accounts were compromised where Blizzard communicates to us that there was a breach - I'll eat my words.

Yes, thank you for your insight, we're all dumb. :rolleyes:
Tell us how YOU know this is not a "Sony-level" attack.
 
I already did, see below.

timtheencahntor said:
There's way too much at risk to be doing that

Are you one to believe that this is just a conspiracy? Seriously. I am not joking. If so, then you don't need much more explanation and I won't be able to reason with you. The amount of legal issues that can come about when telling the public, "We do not have a breach." When you actually do have one? Forget it, the company would be in court real quick. Just like Sony was.

But Blizzard has been through this before. Many accounts in Warcraft have been hacked because people didn't have authenticators and used crappy passwords, shared passwords amongst various accounts on the internet, or whatever else. I mean, the variables are so incredibly enormous that no one can pinpoint "when" they got hacked. It happens.

I call people "dumb" because they are acting dumb about this. Not because they are actually idiots. It's just pride, and people who think they are invulnerable are making the biggest mistake when it comes to this.

I just don't see how anyone can see it any other way. But hey, if Blizzard was indeed hacked and admits to it, I'll admit I was wrong in making these comments. Unfortunately, those who are being hacked aren't willing to think it might actually be them. *shrug* Jester is correct. When a company's customer base is as big as Blizzards, the amount of people saying their hacked to the proportions of actual hacking metrics are - it becomes clear that it really is a minority.
 
There have been over 6 million copies sold of the game. If it was a sony-level hack, that would mean we should be seeing far more account compromises.
 
Thoughts (that have already made their rounds on various forums:

-If people's systems were compromised, why are scans coming up clean?

-If this hack/compromise is so utterly fantastic, why would they ONLY target a blizz account? Surely with such a great tool, hackers would go after something far more valuable on user's systems

-People lie, so do companies. Blizz is not an exception to this.

-It has been suggested that there may have been a mass breach of data, and that hackers are simply using old user data to get into accounts. The reason why an authenticator works is that those passwords are always "new" and not in that set database. This would explain why users that have not logged on / not had a compromised computer had their accounts hacked.

-It has also been suggested that hackers are simply brute forcing user accounts. Since the log on screen has no "lockout" after failed attempts, they can use a simple script to spam log on attempts until they get a hit. Authenticator passwords could technically be brute forced as well, but would add a significant amount of time to the process, but still doable.

-A combination of the a compromised database + a brute force would get people even if they changed passwords, as MANY people simply use a modified version of an old password (change a letter or a few numbers but still remain virtually the same)

-Blizzard's servers have undergone a massive amount of maintenance in the past few days, yet the patch notes imply only a tiny amount of changes on the user end. As well, the *real* server issues that players are having (failed logon's, lag, AH errors) are still around, suggesting that the work done was on some other aspect of the code.
------


All in all, while I'm sure that many people "hacked" were their own fault in some way, I personally don't trust blizz, I'm pissed off at their responses (especially snarky/insulting community managers), and it kinda sucks that there are so many blind fanboys to defend them. I'm not saying there was definitely a breach on the Blizzard's end, but denying the possibility is textbook fanboyism.
 
-If people's systems were compromised, why are scans coming up clean?

Because it may not be a "virus" or a "malware." It may also be a zero-day exploit that has not been discovered. Honestly? We don't know.

-If this hack/compromise is so utterly fantastic, why would they ONLY target a blizz account? Surely with such a great tool, hackers would go after something far more valuable on user's systems

Because Blizzard accounts are very lucrative. People on this forum admit to buying gold (see the thread on this very sub-forum).Those whom buy gold are essentially buying gold that is usually stolen from others. They are not always just farmed gold that these companies make. Yet, it's fine because they don't have time like they used to and it makes it easier. I guess if they get hacked, it couldn't possibly be the same people. It's a weird confirmation bias.

-People lie, so do companies. Blizz is not an exception to this.

Exactly. Which is why I would eat my words if Blizzard does say there is a breach. However, how can gamers so easily lambast Blizzard and not the gold companies they are buying from? In my mind, those whom buy gold are fine with that aspect so they can catch up. Who cares if it comes from someone else's hacked account? In these situations, more and more I think it's just heavy-handed trolling and I think spreading misinformation is just popular or something.

-It has been suggested that there may have been a mass breach of data, and that hackers are simply using old user data to get into accounts. The reason why an authenticator works is that those passwords are always "new" and not in that set database. This would explain why users that have not logged on / not had a compromised computer had their accounts hacked.

Authenticator has nothing to do with old user data. It is a handshake method and the code is only valid for a short time. If there is old data, and no authenticator attached, I can totally see someone using creative social engineering tricks to get onto an old account.

-It has also been suggested that hackers are simply brute forcing user accounts. Since the log on screen has no "lockout" after failed attempts, they can use a simple script to spam log on attempts until they get a hit. Authenticator passwords could technically be brute forced as well, but would add a significant amount of time to the process, but still doable.

I'm not sure how to answer this, it is plausible. But. when I detect brute force methods on my network, alarms go off (that is - the technology has built-in detections). It's an OLD trick and very easy to cut off. In my mind, if they were using this, I wouldn't say it is efficient against today's technology.

-A combination of the a compromised database + a brute force would get people even if they changed passwords, as MANY people simply use a modified version of an old password (change a letter or a few numbers but still remain virtually the same)

See above answers this. I just don't see all of this coming together on such a large scale.

-Blizzard's servers have undergone a massive amount of maintenance in the past few days, yet the patch notes imply only a tiny amount of changes on the user end. As well, the *real* server issues that players are having (failed logon's, lag, AH errors) are still around, suggesting that the work done was on some other aspect of the code.
------

This may actually be the network topology. I'm not saying brute forcing can be a factor, but this seems to be what you are alluding too, and I just don't see it affecting so many servers on Blizzard's end. It's also happening worldwide, which would mean that there must be a huge amount of hackers all gunning for D3.

All in all, while I'm sure that many people "hacked" were their own fault in some way, I personally don't trust blizz, I'm pissed off at their responses (especially snarky/insulting community managers), and it kinda sucks that there are so many blind fanboys to defend them. I'm not saying there was definitely a breach on the Blizzard's end, but denying the possibility is textbook fanboyism.

The thing is, you can't trust anyone. You can't trust my opinion, Blizzards, the hackers, or even people saying they are getting hacked on the 'net. But I have noticed one trend: Those who say they are hacked, when asked about details, end up deflecting the conversation. That isn't to say it doesn't happen, but there are more fakes who hate Blizzard than actual upset customers.

In addition, I don't think people appreciate opinions...and it seems to make conversations like this go south. Instead of just letting it go, people call each other fanboys or whatever else. In my mind, it becomes entertainment to those people to see just how far they can pull an argument along without people catching on.

Popcorn and such, I guess.
 
-If this hack/compromise is so utterly fantastic, why would they ONLY target a blizz account? Surely with such a great tool, hackers would go after something far more valuable on user's systems

Because stealing Bank Account/Credit Card Info/Pick Your Poison across international lines could lead to international prosecution. It's much easier and not nearly as illegal to steal digital items from a digital account to sell for real money.
 
The thing is, you can't trust anyone. You can't trust my opinion, Blizzards, the hackers, or even people saying they are getting hacked on the 'net. But I have noticed one trend: Those who say they are hacked, when asked about details, end up deflecting the conversation. That isn't to say it doesn't happen, but there are more fakes who hate Blizzard than actual upset customers.

My account was hacked. I'll glady be completely honest about it and share any details about it without "deflecting the conversation". If i did something wrong, I'd like to know what it is.

-I have never bought gold for any game.
-I only played with real life friends and have never joined a public game
-I have a clean system, no malware or spyware
-no other accounts of mine were affected (email, banking, steam, etc.)
-I have never played WoW
-I do own Starcraft II, but only played it once and that was single player (hated it)
-My battle.net password it unique from all my other passwords
-I do not have an authenticator and never heard of it until now (should come bundled if its this necessary).
-I only have 1 character (46 witch doctor)
-my account was compromised sometime between 10pm May 29th and 6pm May 30th
-the automated account recovery has not restored anything yet
-3 new users appeared on my recent players list since i was hacked: xererer, Romeisbak, Olarad
 
My account was hacked. I'll glady be completely honest about it and share any details about it without "deflecting the conversation". If i did something wrong, I'd like to know what it is.

The thing is, I am not looking to debunk whether you were hacked or not. If you were legit hacked, then there's nothing for you to prove. It's plain and clear as day. It's the trolls that have something to prove and keep insisting on these things. That's what I am addressing.

Hope it works out for you.

Here's a recent post by ars staff on one of them getting hacked (no authenticator):

http://arstechnica.com/gaming/2012/05/my-brief-life-as-a-diablo-iii-hacking-victim/

It wasn't until I had been through this entire process, and I was talking about potential security threats with an expert, that I realized that my password security might not have been as airtight as I thought. The password I've been using for my Battle.net account was the same one I used to use on services such as Twitter and PSN before they were potentially compromised through well-publicized hacking scandals. I've updated most of my crucial accounts with much more secure, unique passwords since then, but I'd forgotten to change my Battle.net password in that time (and simply forgot that the old password was in any way insecure).

This seems like the most likely security hole, in hindsight, and one that could have been easily closed had I been more vigilant, or quicker to sign up for Blizzard's two-step authentication service (a measure, it should be noted, that's more secure than those offered by most banks). Still, I'll probably never be completely sure how I briefly lost all my progress in Diablo III, and the whole affair has made me quite a bit more paranoid about my computer security. I can only hope that the experience serves as a cautionary tale for me and others going forward.

You mention your password was unique so that part doesn't apply, but I mean, who knows? It's just fate dealt the hands. Those whom need someone to blame start ringing up some crazy conspiracy and just yell out, "It *HAS* to be the company. It CANNOT be me!" I just...*shrug* at that. It just makes me a little sad that some people *need* that.

I found an interesting comment actually, from a Forbes article about what a lot of people in the forums are saying. It hits the nail on the head here:

I was an avid WoW player for 6 years, so people getting their WoW accounts, and later, their Battle.net accounts, hacked is not unique to you at all. It’s been played out millions of times before. As a result, Blizzard has developed a great many very good security measures over the years to help combat this, including the streamlined account restoration process and the authenticator. Over that time, I have found a few details that were very consistent.

1. The Blizzard servers have never been hacked. Only individual accounts, like yours, have been hacked.

2. No account that had an authenticator on it at the time has ever been hacked.

Now, it seems you signed up for a Battle.net account and just assumed that your current practices were the safest possible. That position in itself puts you in bed with millions of others that have been hacked before you. Believing you were secure is probably the biggest reason as to why you feel so unsafe and betrayed now.

If you had not believed yourself beyond reproach when it comes to your personal security, you might have taken a few minutes and go to the Battle.net website, where you would have seen that, in the Support section FAQ, under Security, they list a good deal of information regarding the authenticator. It isn’t hidden, they just don’t shove it down your throat.

What I find most interesting is that you knew people were getting hacked before you got hacked, even someone you knew personally, so you had the motive and opportunity to seek out the information necessary to secure your account.

Blizzard provided what you needed to keep from getting hacked, but you were comfortable that you were as safe as possible already.

Over my 6 years of WoW, I have heard this same exact story played out millions of times, some of them by people in my own circle of friends within the game who got hacked.

All of them decry: “But, I don’t click bad links!” and “But, I use unique passwords!” Some even say: “But, I didn’t know about the authenticator!”

In all cases, they, like you, had heard of others being hacked, even friends. In all cases, they could have looked up security information on Blizzard’s website before they got hacked themselves to see what sort of security measures Blizzard offers to ensure your account doesn’t get the same treatment.

You had all the information you needed, but it seems you may not have realized it at the time, and were comfortable that you were completely secure.

Please help your readers learn from this situation: You should never assume that you are as secure as possible. Assuming you are not secure gives you the motivation to seek out information that will help you be more secure, and it will give you the emotional mindset to deal with getting hacked if it does happen to you.
 
Last edited:
Well I just logged in and all my stuff is gone .... sigh.
 
Well I just logged in and all my stuff is gone .... sigh.
Cue the Activision Blizzard apologists calling you a liar, and idiot, a cheater, then claiming you downloaded the game from a Russian porn site, that you bought gold, and that you used hacks. Also Blizzard's server security is flawless and there's no possible loopholes in their code or infiltrations of their servers.
 
Well I just logged in and all my stuff is gone .... sigh.

That's because your dumb like the rest of us, as Timtheblizzardfanboy states. Now u must suffer, but I recommend you get a refund, forget about the shitty game and move on to something better like I did.
 
Cue the Activision Blizzard apologists calling you a liar, and idiot, a cheater, then claiming you downloaded the game from a Russian porn site, that you bought gold, and that you used hacks. Also Blizzard's server security is flawless and there's no possible loopholes in their code or infiltrations of their servers.

Yea this also.
 
That's because your dumb like the rest of us, as Timtheblizzardfanboy states. Now u must suffer, but I recommend you get a refund, forget about the shitty game and move on to something better like I did.

Wow. The amount of vitriol is astounding. How can I be a fanboy if I am willing to totally see both sides? I've already openly admitted that I am willing to be wrong on either side of the argument. I think you are just trying to incite flaming, IMO.

I'm not calling people dumb, I'm saying they are acting dumb. My opinion. If it hurts you too much, you are taking this way too seriously. In fact, you aren't moving on. You are holding on and just replying to the threads with stuff like this.
 
Wow. The amount of vitriol is astounding. How can I be a fanboy if I am willing to totally see both sides? I've already openly admitted that I am willing to be wrong on either side of the argument. I think you are just trying to incite flaming, IMO.

I'm not calling people dumb, I'm saying they are acting dumb. My opinion. If it hurts you too much, you are taking this way too seriously. In fact, you aren't moving on. You are holding on and just replying to the threads with stuff like this.

You're willing to be wrong just in case this all does go against Blizzard so you don't feel as dumb as we do right now...but I'm not the one flaming anyone, I admitted to be part of the dumb actors as you've stated we are...
 
I just installed an autheticator on my phone ... frustrating.:mad:
 
Well I just logged in and all my stuff is gone as well...

I don't even own the game, but see how easy that was on a forum which can't confirm/deny your story
 
More info; have you bought gold, downloaded any warez at all, visit random porn sites? Unique password on Blizzard account? Secure unique password? Authenticator attached?
 
^ ^ lol! Dudes is it really worth it? Just get a refund...by continuing this you're just sending Blizzard the message that this is all acceptable when it's really not.
 
^ ^ lol! Dudes is it really worth it? Just get a refund...by continuing this you're just sending Blizzard the message that this is all acceptable when it's really not.

I guess the only other option is ask Blizzard support for a roll-back, install an authenticator, and hope for the best? Shouldn't Blizzard be addressing this issue rather than continuing to make posts insinuating that the supposed vast majority don't get hacked?
 
i know having to use an authenticator is straight up bs, but has anyone that has solidly/religiously used an authenticator been hacked yet? I started to use mine when I first read about the authenticator ability shortly after the first attacks...i would've used it from the get-go had I known about it. I really do not want to waste my time in this game getting the gear only for it to be swept away by some asshole.
 
I have the key fob authenticator. I also have it set up to text me of any changes made to my account. Never been hacked. I should add that I have had the key fob for over three years
 
1) Use an authenticator if you can. Mobile or Dongle only. Dialup and WoW will not work
2) Move any valuable items you have onto the 2nd page of your stash, and cover the first page in junk. Items you wear and in your inventory will be destroyed when you are hacked and are not safe. You will lose your gold no matter what
3) When logging off after a sesson, log into a smurf character, a level 1 monk for example. This will make him your active character, so he is the one the bot logs onto instead of your valuable one. This will not protect you if you are hacked while online (on your good char)
4) Do not attempt to fight the hackers for control of your account. If they kick you offline, do not try to keep logging in, or they will change your password. Be passive and wait 15 minutes to make sure they are done.
5) File a support ticket as you can on the bottom of this website's page, which may rollback your account. Rollbacks may not save all your progress, because they could be up to a week old and restore you to less gold/items than you had before being hacked. After the first rollback, you cannot use the RMAH until you get an authenticator, and after the second rollback, you cannot use the RMAH permanently
6) Do not join/create public games. The hackers looking for accounts to target by searching public games; you can be targeted for simply being in the same game as one of their bots.
7) Do not be on your friends friends list. Likewise, do not put him on yours. If one account is compromised, they will be able to see a network of accounts on friends lists spanning off from it and target those in turn.
8) Store your liquid assets in other forms than gold. You will lose your gold if you get hacked, so investing in items or materials can be a safer method.

Phishing, keylogging, malware, session hijacking, etc all have nothing to do with this exploit at all, and avoiding user error will not protect you whatsoever. The safe method to avoid being hacked right now is to use a valid authenticator, and there are no guarantees that this same exploit can't be expanded to bypass authenticators too, however I view that as improbable. If you cannot get an authenticator for whatever reason or have to wait to set one up, use the simple methods I have outlined to minimize the damage you will experience.

----not my post just a copy/paste
 
1) Use an authenticator if you can. Mobile or Dongle only. Dialup and WoW will not work
2) Move any valuable items you have onto the 2nd page of your stash, and cover the first page in junk. Items you wear and in your inventory will be destroyed when you are hacked and are not safe. You will lose your gold no matter what
3) When logging off after a sesson, log into a smurf character, a level 1 monk for example. This will make him your active character, so he is the one the bot logs onto instead of your valuable one. This will not protect you if you are hacked while online (on your good char)
4) Do not attempt to fight the hackers for control of your account. If they kick you offline, do not try to keep logging in, or they will change your password. Be passive and wait 15 minutes to make sure they are done.
5) File a support ticket as you can on the bottom of this website's page, which may rollback your account. Rollbacks may not save all your progress, because they could be up to a week old and restore you to less gold/items than you had before being hacked. After the first rollback, you cannot use the RMAH until you get an authenticator, and after the second rollback, you cannot use the RMAH permanently
6) Do not join/create public games. The hackers looking for accounts to target by searching public games; you can be targeted for simply being in the same game as one of their bots.
7) Do not be on your friends friends list. Likewise, do not put him on yours. If one account is compromised, they will be able to see a network of accounts on friends lists spanning off from it and target those in turn.
8) Store your liquid assets in other forms than gold. You will lose your gold if you get hacked, so investing in items or materials can be a safer method.

Phishing, keylogging, malware, session hijacking, etc all have nothing to do with this exploit at all, and avoiding user error will not protect you whatsoever. The safe method to avoid being hacked right now is to use a valid authenticator, and there are no guarantees that this same exploit can't be expanded to bypass authenticators too, however I view that as improbable. If you cannot get an authenticator for whatever reason or have to wait to set one up, use the simple methods I have outlined to minimize the damage you will experience.

----not my post just a copy/paste

Sound advice but you got to be kidding me! Why even bother. Already been stated but at least Sony had the class/character to come right out and say we have a problem. Then again Sony was hated Blizzard has legions of zombie's to defend them.
 
That list is freaking ridiculous. Blizzard needs to sort this out pronto - I have ~six IRL friends who play this game and now two of them have been hacked (one of them exclusively played private games with me). This is way too prevalent if you ask me.
 
http://us.battle.net/d3/en/forum/topic/5589541918

Wouldn't put too much credibility on that quote, the original poster of that has been posting a lot on the D3 forums claiming to be a hacker or know the hackers. He hasn't provided any proof and it's fairly likely he's just trolling, using hack reports to craft his statements.
 
I'm not sure why they don't implement something like Steam Guard where you have to identify through an email code each new machine you want to log in from. At that point, if you get compromised, it would seem to be more attributable to an issue on your end.
 
This is nothing, if any of you had played WoW or knew friends that did, you would know this has been happening for the last 8 years or whenever WoW came out.

The Authenticator DOES NOTHING, you still get hacked so it's a waste of money. In the end Blizzard is just crap when it comes to security.
 
Back
Top