Aug 10th, 2012

Blizzard let it be known that their service was compromised via a security update post on their site. The hack is said to have obtained possible personal information from various users like email addresses, personal security question answers, and  information relating to Mobile and Dial-In Authenticators. That being said, Blizzard is fairly confident (as confident as one can be in this type of situation we guess) that no financial or location based info, such as credit card numbers or home addresses, were taken. Blizzard states:

Even when you are in the business of fun, not every week ends up being fun. This week, our security team found an unauthorized and illegal access into our internal network here at Blizzard. We quickly took steps to close off this access and began working with law enforcement and security experts to investigate what happened.

Some data was illegally accessed, including a list of email addresses for global users, outside of China. For players on North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) the answer to the personal security question, and information relating to Mobile and Dial-In Authenticators were also accessed. Based on what we currently know, this information alone is NOT enough for anyone to gain access to accounts.

Blizzard stated that although passwords seem to have been compromised, they use a specific security protocol which cryptographically scrambles passwords to make them harder to figure out in the event of a security breach such as this. Even with the added “Secure Remote Password protocol” Blizzard is still urging users, especially those in North America, to change passwords as a precaution. They stated:

We also know that cryptographically scrambled versions of passwords (not actual passwords) for players on North American servers were taken. We use Secure Remote Password protocol (SRP) to protect these passwords, which is designed to make it extremely difficult to extract the actual password, and also means that each password would have to be deciphered individually. As a precaution, however, we recommend that players on North American servers change their password. Please click this link to change your password. Moreover, if you have used the same or similar passwords for other purposes, you may want to consider changing those passwords as well.

Have you been affected by this? Let us know.