Codemasters websites hacked & user data compromised

[Pave Low]

Dear valued Codemasters customer,

On Friday 3rd June, unauthorised entry was gained to our Codemasters.com website. As soon as the intrusion was detected, we immediately took codemasters.com and associated web services offline in order to prevent any further intrusion.

During the days since the attack we have conducted a thorough investigation in order to ascertain the extent and scope of the breach and have regrettably discovered that the intruder was able to gain access to the following:

Codemasters.com website

Access to the Codemasters corporate website and sub-domains.

DiRT 3 VIP code redemption page

Access to the DiRT 3 VIP code redemption page.

The Codemasters EStore

We believe the following have been compromised: Customer names and addresses, email addresses, telephone numbers, encrypted passwords and order history. Please note that no personal payment information was stored with Codemasters as we use external payment providers, meaning your payment details were not at risk from this intrusion.

Codemasters CodeM database

Members' names, usernames, screen names, email addresses, date of birth, encrypted passwords, newsletter preferences, any biographies entered by users, details of last site activity, IP addresses and Xbox Live Gamertags are all believed to have been compromised.

Whilst we do not have confirmation that any of this data was actually downloaded onto an external device, we have to assume that, as access was gained, all of these details were compromised and/or stolen.

The Codemasters.com website will remain offline for the foreseeable future with all Codemasters.com traffic re-directed to the Codemasters Facebook page instead. A new website will launch later in the year.

Advice

For your security, in the first instance we advise you to change any passwords you have associated with other Codemasters accounts. If you use the same login information for other sites, you should change that information too. Furthermore, be extra cautious of potential scams, via email, phone, or post that ask you for personal or sensitive information. Please note that Codemasters will never ask you for any payment data such as credit card numbers or bank account details, nor will Codemasters ask you for passwords or other personal identifying data. Be aware too of fraudulent emails that may outwardly appear to be from Codemasters with links inviting you to visit websites. The safest way to visit your favourite websites is always by typing in the address manually into the address bar of your browser.

Unfortunately, Codemasters is the latest victim in on-going targeted attacks against numerous game companies. We assure you that we are doing everything within our legal means to track down the perpetrators and take action to the full extent of the law.

We apologise for this incident and regret any inconvenience caused.

We are contacting all customers who may have been affected directly.

Should you have any concerns or wish to speak to a member of our Customer Services team, please email them at custservice@codemasters.com.

[Rocky]

Bloody hell, this is getting beyond a joke. These companies are needing to be made accountable for their lack of security.

[Zeealex]

blame windows!!

no on a more serious note, it is, like rocky said, getting beyond a joke, and the only people who are responsible are the companies themselves for not making their sites or servers more secure. i think compensation should be given to customers who lost data. and a fine given to the companies then they would get a kick up the effing backside.

[KRP 56]

Codemasters just sent me an email saying they also have been hacked and their info compromised. My info wasn't worth looking at.

Edited June 14, 2011 by Pave Low
Post split from the Bethesda thread & moved to the existing Codemasters thread.

[Tinker]

UPDATE: AMD has issued a statement confirming activation keys have been compromised, and added that there might be a delay in redeeming valid vouchers while it looks into the situation.

"This past weekend, activation keys associated with free Dirt 3 game vouchers shipping with select AMD products were compromised," it read.

"These activation keys were hosted on a third party fulfillment agency website, www.AMD4u.com, and did not reside on AMD's website. Neither the AMD nor Codemasters servers were involved.

"We are working closely with Steam, Codemasters, and our fulfillment agency to address the situation. AMD will continue to honor all valid game vouchers, however the current situation may result in a short delay before the vouchers can be redeemed."

ORIGINAL STORY: Hackers have stolen access to three million digital copies of Dirt 3.

The huge list of Steam download codes was taken from AMD's redemption site, AMD4u, which was compromised.

The keys were stockpiled for use in a promotion with AMD graphics cards, reported Kotaku.

According to posts on Steam's forums, the codes were discovered in a .sql database and accessed with a simple .htaccess exploit.

Steam codes can be traced by developers, meaning Steam is able to block hacker's access to the game. Codemasters told Eurogamer it hopes Steam will deactivate the codes. A statement from AMD is expected shortly.

In June Codemasters admitted its website had been violated by hackers, with encrypted passwords, email addresses and user names stolen.

Apparently CM forums are still not excepting new registrations from back in June? Not exactly living up to there name at present.

[Rocky]

Not exactly living up to there name at present.

LMAO too funny.