Pierluigi Paganini
January 09, 2017
Bad news for gamers, the E-Sports Entertainment Association (ESEA), one of the largest competitive video gaming communities was hacked in December. The data breach exposed the profiles of more than 1.5 million players.
The incident was also confirmed on Saturday by the breach notification service LeakedSource that reported 1,503,707 ESEA records were compromised.
The records include username, first and last name, password bcrypt hash, email address, registration date, city, state (or province), last login, date of birth, zip code, phone number, website URL, Steam ID, Xbox ID, and PSN ID.
As you can see the profiles are very detailed, the use of the bcrypt hash protect users’ passwords, anyway gamers are exposed to a wide range of malicious activities such as social engineering attacks and spear phishing attacks.
ESEA shared the link to the following “Outage and Security Update” via Twitter.
“Recently news has been made that ESEA’s user data has been leaked online. We expected something like this could happen but have not confirmed this is ESEA’s data. We notified the community on December 30th, 2016 about the possibility this could happen. The type of data and storage standards was disclosed. We have been working around the clock to further fortify security and will bring our website online shortly when that next round is complete. This possible user data leak is not connected to the current service outage.”
ESEA Outage and Security Update
Read: https://t.co/M2plmwhzmG
— ESEA (@ESEA) 8 gennaio 2017
The company was informed of the data breach on December 27 and issued a security warning on December 30, 2016. At the time I was writing, ESEA only confirmed the data leak, but still hasn’t admitted that profiles were accessed from its systems.
The news of the ESEA data breach is circulating on the Internet, many players confirmed it on Reddit.
.@BigSecurityNews confirmed my ESEA account info after they asked a couple ‘larger’ followed users to help verify
— Jimmy Whisenhunt (@jimmywhis) 8 gennaio 201
Salted HASH, quoting a LeakedSource spokesperson, reported that the ESEA data breach was part of a ransom scheme. Crooks demanded $50,000 in payment to avoid disclosing the hack.
In response to the incident, the company reset passwords, multi-factor authentication tokens, and security questions.
[adrotate banner=”9″]
(Security Affairs – ESEA data breach, hacking)
