Ourmine hackers breached into the Unity Forum

Ourmine hackers breached into the Unity Forum and informed its users that they had gained access to a database containing the details of 2 million records.

The notorious hacker group OurMine made the headlines once again, this time the victim it the Unity Game Engine forum.

The group has defaced and hacked the Unity forum over the weekend and used its data to send out emails to registered users via a built-in mass email feature.

The messages inform the Unity forum users that they had gained access to a database containing the details of 2 million users and suggest them to change their passwords.

OurMine is known in the hacking community as a group that hacks to create awareness on cyber threats and suggests victims the right cyber posture.

Below a copy of the message sent to the users:

Unity has admitted the data breach in a blog post published today, it blamed the incident on “poorly implemented password routines.” The company tried to reassure its users confirming that the hackers only accessed “a limited set of data,” and adding that no passwords or financial data had been compromised.

“On April 30, our public forum website was attacked and successfully compromised due to poorly implemented password routines; our investigations show no theft of passwords in this attack, nor impact to any other Unity service.” reads the blog post.

“However, the attack did result in defacement of the site (which has since been fixed) and subsequent messaging to all of our registered forum users.”

Even if the hackers did not access any password, Unity suggests changing the password.

“No passwords were lost in the breach, but we still recommend a password change due to possibility of the group having emails and passwords from another source, which could be used to access their account,” Unity representatives said.

The company plans to improve the authentication to its service by introducing two-factor authentication, a login alerting mechanism, along with a new password policy.

The company took offline the forum following the hack, at the time I was writing it is once again up and running. The forum was restored using a backup timestamped April 30, 14:01 CEST, this means that some posts may have been lost.

Last time we met the OurMine group was in January when the crew hacked the New York Times Twitter video account.

The group, who hacked the Netflix US Twitter account (@Netflix) in December to promote its website and hacking services, is known for its attacks against high-profile Twitter accounts. The list of victims is very long and includes Mark Zuckerberg, Twitter co-founder Evan Williams, David Guetta Daniel Ek, former Twitter CEO Dick Costolo, Twitter CEO Jack Dorsey, the CEO and founder of Spotify, Google CEO Sundar Pichai, and many others.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Unity forum, OurMine)

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.