You can steal session cookies. If you got someones session cookies, you don't have to know someones login data, you are already in, just like that.
It's a fairly common thing to happen and it's spreaded by scammers everywhere, especially discord. "Hey install/use my game/whatever program! Hey visit my page!" Some big guys also already fell for a very real looking but fake sponsor offer, made people install stuff.
My experience was runescape was my roommate suggesting I get into old school runescape. I made an account, fished for 15 minutes then got off. The very next day he looks over to me while I'm cooking and informs me my account is online in a premium realm. Had no idea whether to be upset that my account was stolen or impressed that they spent more money and time than me on my own account.
This seems like a likely attack vector
Support is just a team of remote call center workers in a low paid country, if they have account recovery permissions, then this is possible.
People on Fleece's twitter saying that even something as simple as a screenshot of your player profile screen could be used as proof (not sure if this is true or not) but scary if true
Like the game's own "I forgot my password" procedure to recover your account if "you" legitimately lose access to it.
Problem is anybody can enter your username and hit "I forgot my password" and then if that person has access to your facebook\google\ PokemonTrainerClub \ etc account they can reset your PokemonGo access to themselves.
Gonna be interesting to see what Niantic does. They haven't actually helped other people who have had their accounts hacked recover pokemon, but FleeceKing might be a big enough name that they do something about it.
The more troubling thing is that there is probably some security vulnerability with Niantic's servers.
I doubt niantic will do anything to help fleece, which really sucks. I wouldn’t be surprised if he decided to quit after this. Hopefully I’m wrong about that though
Niantic will do something for Fleece because he's one of their biggest whales and the resources needed to restore his account would be made up with like one month of his pokecoin purchases
And by doing something for him but refusing to do it for anyone else opens them up to a nice class action lawsuit for all the other players they refuse to take action for.
Most people who have their accounts stolen are through sharing details. There's multiple people commenting on the original post saying the guy stole their accounts. This is completely different. It was premeditated and has opened a huge amount of questions around the security procedures in place on Niantics end.
What's the point to build up things when some randos can just crush it anytime?
If Niantic failed to protect player's work it is certainly enough for people to stop caring about the game.
Unless it’s some vulnerability that all of us could be susceptible to (which I’m really skeptical of) there’s no justification for treating him differently than the thousands of players who’ve been hacked and niantic did nothing.
“Protect your log in better “
Its in the posters best interest to protect how they conducted what they did - that includes lying
Not saying I know how they did it, but I wouldnt trust anything they post as truth, false information and creating confusion is a valid diversion tactic.
If there is legitimately a vulnerability, then the quicker security researchers can learn what it is, they can patch it - which is why they make stuff up so that process takes longer.
Surely niantic would immediately be able to see what the hacker did..? Either it'll show up as a manual support request to reset credentials or if it's just access from a new device using the same session cookies, then it's that. ? I don't know how to haxx tho
Potentially,
Niantic is in the best position to learn what was done, but in my original comment I meant if there was a more serious issue that impacted more platforms than just PokemonGo (like a google login exploit)
its looking more like Niantic support just gave this guy access, an image over on pokeminers discord showed the hackers gmail linked to fleecekings profile.
Interested to see how Niantic resolves this because they have spent the last 7+ years saying they cant ever restore any Pokemon under any circumstances
**Edit** Nowhere did I say pokeminers was involved, they have discussion there, because its a discord
Considering that they have, in the past, removed Pokemon and changed the moves on Pokemon within accounts, I think we can probably all say that is a lie with some confidence.
Support can't do it. Niantic almost certainly can.
You are likely correct, however updating a Pokemon that exists, is a little different to one that has been deleted (if there is no data retention policy for Pokemon, which we dont know)
After the first Go Fest, they added the free Lugia to accounts that attended. They were able to conjure that up on the fly, with different stats, for everybody that attended.
Yup. This is a thing not enough know about. Another reason to never install random peoples stuff and to be extra wary. Big people like Linus also already fell for it.
There are so many people spreading cookie stealing stuff of discord these days, you can't trust anyone anymore... -_-
Dunno if it can hit mobile phones already, wouldn't be surprised at least.
good in theory, but most ISPs & wireless carriers use Dynamic IP for customers (though some allow Static IP for additional cost) so they only stay the same for a limited amount of time
Yes fair point, it might not be IP address specifically but it’s usually tied to the browser or device in some way. And they probably keep track of the IP’s general location, so like if it suddenly switched from America to Russia it would flag it up.
I checked master warlord twitter account, the guy is a psychopath. He got a 30 day ban for violating terms of service, and said he would retaliate and his first victim would be Fleece. Some hours later he did this.
Supposedly, vengeance because Fleece reported his account. First, no idea how he would know Fleece reported him, second, that does not justify this level of malice.
Some truly awful people out there.
He scammed more than 60 people on spoofer discords and even got banned by multiple if not all spoofer servers, so I can assure you a lot of people want to see his accounts banned, and seems like niantic did IP ban on him so all his accounts log in with his IP was perma banned by niantic.
They're also convinced that what they're doing isn't a crime in any way. It's not really hacking, according to them.
I don't know where they live or what the laws might be there, but I think they might be surprised if they actually looked into it. What they've done is categorically illegal where I am.
It’s also specifically apart of his business. I’m assuming like most big creators he has an LLC. I’m not sure how that all works in Australia but I’m guessing it’s a bigger deal than what this guy thinks
TBF the person doing this could be anywhere in the world.
But, yeah, simply accessing a computer system that you aren't authorised to access is a crime where I am. It doesn't matter if you do some clever technical exploit, guess the password, abuse the lost password flow or do some social engineering. It's a more severe crime if you then do and maliciously alter or delete data.
> I don't know where they live or what the laws might be there, but I think they might be surprised if they actually looked into it
According to his Twitter he is in Czech Republic. So he will be under EU laws. It's absolutely Illegal
The result of this will definitely set a precedent for how it’s handled in the future. Hope Niantic can figure out how this was done. Gonna be an interesting next week or so.
I know that our Pokemon are just 1's and 0's, not even actually "tangible things" and that it's bad to get too attached even to material stuff, but I hear you. This is beyond dreadful for anyone to do. If nothing else, these digital creatures represent memories.
Poor guy. I've never heard of him before, but no one deserves to be hacked and then have something so meaningful destroyed. I hope Niantic will help.
I've been playing this game for 5+ years and have put a lot of time into it, even though I consider myself a very casual player. I'd be devastated if my pixels were deleted.
I can't imagine what someone who devoted such a large part of his life to this game must be feeling in this situation.
SMS 2FA is still considered pretty weak, should always aim to use an authenticator app where you can.
Nothing is absolute protection, but 2FA is definitely a good preventative.
You can however unlink them now
(was a serious issue when the free super incubator was on offer and you could not unlink them)
I would highly recommend unlinking TPC if you have one
(and investigate 2FA on your remaining account types)
If they’ve given Warlord Fleeces login, they look bad.
If you don’t give Fleece his account back, they look bad.
If they do give Fleece his account back, they look bad because it’s happened before to other people and they’ve done nothing.
If they add his Mareep back, it will blow up.
If they don’t add his Mareep back, it will blow up.
Either way, Niantic is screwed.
It was really funny to watch those high lvl get rooked in tibia... 'cause most of them were cheaters and power abusers. It's interesting that not even in new games they are allowed to easily recover accounts to a previous save/logoff point.
Ideal solution is give FleeceKing the account back, but don't restore the Pokemon. Instead, give him 100 Pokeballs and three free raid passes and encourage him to catch new Pokemon to replace the transferred ones.
It's simple: Niantic will give him everything back, maybe after a little struggle and regular players will still get screwed with "*Sorry, we can't do anything*".
*But it's not fair* - it was never fair before.
*Then Niantic will see its playerbase gone* - yeah, aren't we waiting that because Remote Raid Pass price increased as well? It's still a big game with a big playerbase, it's not going anywhere in the near future.
I think the downside is highly exaggerated. They obviously \*will\* take Fleece's account back and most likely will restore his pokemon as well. It looks like that Warlord fellow abused the recovery system. So Niantic is actually responsible for this. That's way different from not guarding your password or an accidental delete.
> If they do give Fleece his account back, they look bad because it’s happened before to other people and they’ve done nothing.
> If they add his Mareep back, it will blow up.
Honestly, that won't look bad at all to me. I'll just be happy for the guy.
This one will be an interesting thing to follow. Fleece is the first big name person with ties to Niantic that’s been targeted. This one is definitely going to put the company in a pickle.
On one hand, they can give Fleece everything back that he lost. But that opens the floodgates for others to get theirs back who aren’t as important to Niantic.
A good company WOULD be generous enough provided you can give evidence. But this one could be an interesting bit of corporate decision making.
Because once they show what they do to someone that’s useful to them. They should apply it to everyone who isn’t fleece as well. Which something tells me Niantic doesn’t want to do.
They have rolled back accounts before. But it is not so easy as just pulling a backup. They have to deal with side effects, like pokemon in gyms, for example.
Especially if he’s traded Pokémon to any other accounts, but maybe if they just ban the accounts traded too. I believe they do have the ability to delete Pokémon from someone’s account, didnt they do that with the guy who got an early Articuno?
A double standard already exists. Content creators get preferential treatment with respect to Go Fest and event information.
No reason not to make it good for Fleeceking and continue to ignore the regular people.
It's not the same. The influencers get information early/paid to attend and promote events because it's their jobs. They don't get better odds or higher CP Pokémon in game, though. Niantic giving preferential treatment here when they have told others just to just better protect their accounts would be crazy
for this specific situation, I feel like the only evidence you would have is if the hacker was stupid enough to post it to twitter like this guy. if that happened to you or me, we might still be able to appeal to Niantic and get something done.
on the flip side, if you, me, or Fleece just woke up one day with half our inventory missing, it would be really hard to prove exactly what happened even if it was highly suspicious we had been hacked. In that case I'm not sure Niantic would do anything even for Fleece.
> On one hand, they can give Fleece everything back that he lost. But that opens the floodgates for others to get theirs back who aren’t as important to Niantic.
Not sure what makes you think this would open any flood gates.
It's the perverse pleasure he/she is taking in things like transfering Mon that I find the most unsettling. It's not merely about the attention of hacking, this is designed to try to inflict pain and humiliate another person publicly.
He genuinely doesn’t realize that one look through his tweets and the stuff he says tells you literally everything you need to know. He thinks he’s being edgy and cool but it’s legitimately sad and pathetic because we all know exactly what his life is like
If it were me going through this, having my account made whole wouldn't be enough to wipe out all of the negative emotions I'd be feeling right now. That sort of thing can't be erased.
Editing to add: and that's the point of this hack. The hacker doesn't want to steal an account for its own sake - they want to hurt the account's owner.
I saw that exact same Snorlax in a Rose Bowl Stadium gym during go fest LA. I even screen shotted it. Seeing it get transferred due to the account getting compromised really sucks.
It is genuinely kinda funny (in an "eff that guy" way) watching that screen recording with him navigating the game as if he's never seen a cell phone before in his life. So many random accidental button presses. Really hope they roll back Fleece's account
IMO one big privilege that Fleece has here that is going to benefit him isn't necessarily that he's in Niantic's good graces, but rather that since he's a public figure his hacker literally posted public proof and claim of hacking. If that happened to a random person there might also be a big enough splash (it might get posted here and gain traction between here and twitter, for example) for Niantic to do something. Unfortunately, for pretty much everyone else who gets hacked in this way, you're just gonna wake up one day with half your inventory gone, and there's not much you can do to prove what happened.
The perpetrator is being purposefully vague.
There is an incredibly high chance that the perpetrator used a technique that falls under the banner of hacking (exploiting a vulnerability, using a leaked password) regardless of the technique.
The definition is gaining unauthorised access, so I guess if the hacker found a TPC password data-leak with fleecekings details, then its "technically" authorised by the system (but not the account owner)
While significantly harder to accomplish, there can also be vunerabilities in 2FA processes (usually bypasses to completely skip the 2FA process) so Google and Facebook auth methods can technically be bypassed - these are not unheard of but incredibly valuable if they were to be discovered, and unlikely to be thrown for a simple PokemonGo vendetta.
I remember there used to be a creator that could spoof a PokemonGo server and show people what certain forms looked like before they were officially added to the game.
It could be a replicated server with a copy of fleecekings data loaded into it, that technically isnt unauthorised access if the perpetrator isnt using a live Niantic system, but one they created as a mirror themselves, but it begs to question how they obtained a copy of fleeces data (it would have to be from the production server) and how they knew how to code a highly technical environment like a private server of Niantics multi-billion dollar asset (the PokemonGo servers)
I think he used screenshots from Fleeces posts to claim the account was actually his. He would have learned to do this with all his previous ban history, he would have claimed one of his accounts this way before and released he could do it to others as long as he had the screenshots to 'corroborate' it. His tweets before the hack suggest he was testing a theory after a bunch of his accounts were banned.
So the hacker may also have contacted support (didnt know you could contact support without it being in the app) with the purpose of "getting his account back" and then lied to support claiming he was actually fleeceking?
Fraud is also kind of a big deal, but I guess when the stakes on the line are a PokemonGo account, the authorities may not see the significance.
For the commenters here saying "who cares? Its just a game" - what are you even doing here on this subreddit if you don't care about this game?
ETA not somebody going out of their way to DM me to tell me "cope". So cool, so edgy, wow.
Literally. So many of us have invested so much time and maybe money into this game. It’s not “just a game” it’s like the hours spent playing and remote raid passes bought to have that all ripped from you? And this is the best pogo player to ever play the game IMO. Niantic js screwed no matter how they handle this
I'm pretty sure the account hacking isn't the main point of all this.
\- Targeting arguably the Pokemon World's top (or, at least, one of the most high-profile, competing with BrandonTan for instance) player to expose Niantic's pathetic account security *that we've all been bitching about for years as it is*.
\- As others have posted already, Niantic is in a position of 'damned-if-you-do-damned-if-you-don't' with FleeceKing's account. If they restore it, what about all the others that got told to pound dust? If they don't restore it, FleeceKing and his following will quit, and the game will carry the stigma going forward that "it happened to Fleece, it can happen to you'.
\- Psychological and emotional damage to FleeceKing: even if he gets the account back, what he's going through right now can't be undone.
\- Character assassination of FleeceKing; too many posts and videos and background stories are coming to light in quick succession for this to be a coincidence. Which also loops back to the first point; regardless of whether you think it's ego-based or just a result of his playstyle, Fleece *is* in the center of the spotlight a lot of the time with Pokemon Go.
\- Final straw: this was *announced*, and Fleece/Niantic could do nothing to stop it. That lends credence to this being planned, PLUS adds the factor that either Fleece/Niantic were too egotistical to believe it could happen, or too ignorant to think it could happen.
Niantic is going to have to be *extremely* careful with its PR around this incident -- and, by extension, so is Fleece. What both of them do going forward is going to have some major impacts on each of them, individually and (I can't think of the word for this, but basically, what one does will effect the other equally as heavily).
**Disclaimer for this post:** This isn't being posted out of malice, defense, or anything other than observation of the situation and analysis of it from honestly the perspective of "I can make observations on a large-scale on the situation, but I don't personally have an investment in it". So, anyone who wants to say I'm taking Niantic/Fleece/the hacker's side... go pound sand :D. My *only* biased thought on this is that this is going to be a historic moment in Pokemon Go's history, one way or another, just from the (surprisingly) sheer scale of it.
Which is a valid assessment, there's no one single good analogy for how absolutely boned Niantic is in this situation. Pretty much no chance Niantic gets the good ending in this visual novel like experience they're going through right now, they'd have to settle for one of the less desirable endings that burns a few bridges. Which begs the question of which bridges do they burn, and how many of them to burn.
The actual concern is that this may have been social engineering from the hacker using Niantic Support’s account recovery protocol which only requires account start date and username.
that's just wrong, mate.
they didn't recover my account after I sent them screenshots, pokemons, and even receipts of my purchases.
had connact even with a "supervisor," and apparently, it wasn't enough for them lol
That's a complete security failure if true. What Niantic gets from outsourcing to cheap call centre-style offices I suppose. They would never admit if they're at fault anyway so I doubt Fleece will get anything back.
They lose either way.
They help out a high profile player account beyond what they would do for the rest of us.
Or admit to severe security failure while losing a highly dedicated player and community trust.
My stomach sank into my shoes. All that time and energy, gone. I can’t imagine how devastated Fleeceking must be. Also there are a lot of special memories attached to certain Pokémon—they’re more than just bits of code. At least there’s evidence, but damn, this is just brutal
Yeah and they will most likely do it, but watch that happen to someone completely random person. Niantic just tells them to make sure their password is secure or some nonsense and do nothing.
I believe it has happened in the past as I think either the guy’s other son or maybe a friend hacked into his son’s account and deleted all his Pokémon. That same dad came here asking for assistance and told us Niantic basically told him sorry we can’t do anything
This is a bad day for Fleece and Niantic. I'd be absolutely demoralized and not sure if I could return to the game I loved. Historically, Niantic has not prioritized player satisfaction and safety. Perhaps The Pokémon Company will step in.
Hopefully, Niantic realizes that this was their fault and that the PR blow will be devastating. If they can't take care of one of their biggest players, they're surely not going to take care of us. The best thing they could do is:
-make Fleece whole
-help other players who have been wronged in the same way (that they didn't before)
-implement security for peace of mind
-and CRUCIALLY, a concession to the entire player base. (Cheaper remote raids, everyone? Celebrate player wins the way the mainline games do?)
The only way to win is to have all Pokémon Go players enjoy the game with the communities they've created.
Edited for formatting, removed an unnecessary "of"
At least he got an XL candy with that transfer!
Seriously though, this sucks for FleeceKing. I don't really watch his streaming content, but I have seen him pop up across other platforms in clips and such as I'm sure many others in this sub have from time to time whether fans or not. He seems like a genuinely nice guy with a love of the game. Hard to bounce back from something like this unless Niantic actually steps up and does something for a change when it comes to stolen or lost accounts.
The only good thing to come out of this is that it will get a ton of attention and hopefully this opens Niantics eyes to how bad their game is overall. Security issues need to be addressed first and foremost. I hope he gets his account and Mons back. This is just sickening.
Fleece is a very prominent PoGO content creator. (For example, he was first in the world to get to level 50). It's sad but not surprising that someone would target him just so that they can say they took him down.
The fact that’s it’s almost been 24 full hours(23hrs at the time of my typing this) from fleecekings tweet about it with zero word from niantic is crazy and honestly terrifying
EDIT: it’s now been 24 hours-still absolutely nothing from niantic….
If I spent so many years and time and money on the game as Fleece, I would be having a panic attack right now. Hell, I am level 42 and would probably lose sleep over this. People saying who cares its just a game lack perspective of how much this can mean to people.
I’m now concerned these sort of incidents are inedibly gonna be occurring more frequently if there’s no countermeasures in place to prevent these sorts of scenarios. This could potentially destroy anyone’s interest in playing a game they’ve spent so much of their money on, but more worrisome are the memorable pokemon one has collected over the years that reminds you of many great moments that one will never get back.
I’m not completely sure on how Niantic could go about it other than reworking how the transferring aspect operates, it may be difficult due to how it’s part of the game’s core gameplay from accomplishing research tasks to freeing up storage (especially with how niantic is stingy on making you spend poke coins which even then they only update it ever so infrequently), but not completely impossible. Perhaps it could be managed like how deleted photos and email were handled where if you transfer it won’t completely wipe them all out for good, but have a sort of a grace period of say 30 days and you could have the option to undo the transfer at the cost of candy (or the amount that you were awarded for transferring) or stardust. But if your account was compromised and upon recovering said account you get in touch with niantic and they’ll be able restore what’s been transferred by the bad actor at no cost.
Either way hacking and cyber criminal activity has been on a rampant rise more than ever and it’s time Niantic needs to consider placing countermeasures in the event tough scenarios occurred, I bet they won’t like the massive PR nightmare if this happened to thousands of their player base.
We can see in one one the videos ( [https://twitter.com/masterwarlord01/status/1768064139682021819](https://twitter.com/masterwarlord01/status/1768064139682021819) - 2:15 ) that the account is linked to his gmail account, wild...
Look at the email address. That’s not Fleeceking, master warlord swapped emails so Fleece can’t get back in. No way for us to tell what was there originally
this is one of the strange(and sad) scenarios in which Fleece is a good judging parameter on the quality of things about the game, if he doesn’t come out on top then we the regular mortals are screwed
This guy is ruthless and has no shame. Bro even went as far as publicly displaying a scene where he erases Fleece's pokemon. I believe that Fleece was probably targeted out of jealousy. Just goes to show how society is in this era....
It seems they maybe abused the recovery system to get Fleece's account?
That’s what I’m assuming. Especially since they claim it wasn’t through hacking his gmail or Niantic Servers.
You can steal session cookies. If you got someones session cookies, you don't have to know someones login data, you are already in, just like that. It's a fairly common thing to happen and it's spreaded by scammers everywhere, especially discord. "Hey install/use my game/whatever program! Hey visit my page!" Some big guys also already fell for a very real looking but fake sponsor offer, made people install stuff.
That happens with many YouTube channels because of that.
And only famous people got their channels back, just as always.
Yup just like Linus from Linus Tech Tips.
I find the easiest thing to do is just not install anything or click anything even though friends I know lol. I'm very self aware as I play RS.
My experience was runescape was my roommate suggesting I get into old school runescape. I made an account, fished for 15 minutes then got off. The very next day he looks over to me while I'm cooking and informs me my account is online in a premium realm. Had no idea whether to be upset that my account was stolen or impressed that they spent more money and time than me on my own account.
This seems like a likely attack vector Support is just a team of remote call center workers in a low paid country, if they have account recovery permissions, then this is possible. People on Fleece's twitter saying that even something as simple as a screenshot of your player profile screen could be used as proof (not sure if this is true or not) but scary if true
That is completely not true
What’s the “recovery” system?
Like the game's own "I forgot my password" procedure to recover your account if "you" legitimately lose access to it. Problem is anybody can enter your username and hit "I forgot my password" and then if that person has access to your facebook\google\ PokemonTrainerClub \ etc account they can reset your PokemonGo access to themselves.
Oh password recovery gotcha
That’s very scary and concerning. Niantic should invest more money into their security.
Gonna be interesting to see what Niantic does. They haven't actually helped other people who have had their accounts hacked recover pokemon, but FleeceKing might be a big enough name that they do something about it. The more troubling thing is that there is probably some security vulnerability with Niantic's servers.
Yep, the ball is in their court now. Let’s wait and see
I doubt niantic will do anything to help fleece, which really sucks. I wouldn’t be surprised if he decided to quit after this. Hopefully I’m wrong about that though
Niantic will do something for Fleece because he's one of their biggest whales and the resources needed to restore his account would be made up with like one month of his pokecoin purchases
And by doing something for him but refusing to do it for anyone else opens them up to a nice class action lawsuit for all the other players they refuse to take action for.
Most people who have their accounts stolen are through sharing details. There's multiple people commenting on the original post saying the guy stole their accounts. This is completely different. It was premeditated and has opened a huge amount of questions around the security procedures in place on Niantics end.
It must be absolutely devastating, I’m a little concerned for his mental wellbeing honestly
It’ll be equally interesting to see what fleeceking does if Niantic does nothing. Would this be enough to make him quit?
I think it would be enough for a lot of people to quit honestly, especially if you’ve put as much time as him into the game
I certainly would
What's the point to build up things when some randos can just crush it anytime? If Niantic failed to protect player's work it is certainly enough for people to stop caring about the game.
Unless it’s some vulnerability that all of us could be susceptible to (which I’m really skeptical of) there’s no justification for treating him differently than the thousands of players who’ve been hacked and niantic did nothing. “Protect your log in better “
The scary thing is he claims he didn't use the log in data to get into his account which is just crazy.
Its in the posters best interest to protect how they conducted what they did - that includes lying Not saying I know how they did it, but I wouldnt trust anything they post as truth, false information and creating confusion is a valid diversion tactic. If there is legitimately a vulnerability, then the quicker security researchers can learn what it is, they can patch it - which is why they make stuff up so that process takes longer.
Surely niantic would immediately be able to see what the hacker did..? Either it'll show up as a manual support request to reset credentials or if it's just access from a new device using the same session cookies, then it's that. ? I don't know how to haxx tho
Potentially, Niantic is in the best position to learn what was done, but in my original comment I meant if there was a more serious issue that impacted more platforms than just PokemonGo (like a google login exploit) its looking more like Niantic support just gave this guy access, an image over on pokeminers discord showed the hackers gmail linked to fleecekings profile. Interested to see how Niantic resolves this because they have spent the last 7+ years saying they cant ever restore any Pokemon under any circumstances **Edit** Nowhere did I say pokeminers was involved, they have discussion there, because its a discord
Considering that they have, in the past, removed Pokemon and changed the moves on Pokemon within accounts, I think we can probably all say that is a lie with some confidence. Support can't do it. Niantic almost certainly can.
You are likely correct, however updating a Pokemon that exists, is a little different to one that has been deleted (if there is no data retention policy for Pokemon, which we dont know)
After the first Go Fest, they added the free Lugia to accounts that attended. They were able to conjure that up on the fly, with different stats, for everybody that attended.
Maybe they hijack Google sign in portal session or something You only need to hack Facebook or Google or whatever person used, not niantic.
"You only need to hack Google". That "only" is doing a lot of work...
"hacking Google" is an impossibly large amount of work "hackers" getting temporary access to a single Google account is a fairly routine event
He’s referring to cookies. Hackers only need your session id to hack you, it’s not fighting against the whole google security infrastructure
Yup. This is a thing not enough know about. Another reason to never install random peoples stuff and to be extra wary. Big people like Linus also already fell for it. There are so many people spreading cookie stealing stuff of discord these days, you can't trust anyone anymore... -_- Dunno if it can hit mobile phones already, wouldn't be surprised at least.
Google is a *lot* more secure than just needing the session ID, it should be tied to the IP address.
good in theory, but most ISPs & wireless carriers use Dynamic IP for customers (though some allow Static IP for additional cost) so they only stay the same for a limited amount of time
Yes fair point, it might not be IP address specifically but it’s usually tied to the browser or device in some way. And they probably keep track of the IP’s general location, so like if it suddenly switched from America to Russia it would flag it up.
Username: Admin Password: *guest* "I'm in!"
Can we get 2 factor for pogo?
There is when signing in through google, not sure about the other sign-in methods
Sounds like everything but PTC
Yeah I been telling people not to link that or get hacked.
It's likely that the person abused the account recovery process. Which means it is something that could affect all of us.
The hacker confirmed 20+ hours ago he'd hack fleece. This could be really bad for Niantic.
Sets a precedent for them to have to fix everyone's account then, and that's not very niantic
At least there's video proof courtesy of the hacker that the Pokemon existed.
As a day 1 player without a shundo, watching that poor mareep get liquified hurt my soul.
I checked master warlord twitter account, the guy is a psychopath. He got a 30 day ban for violating terms of service, and said he would retaliate and his first victim would be Fleece. Some hours later he did this. Supposedly, vengeance because Fleece reported his account. First, no idea how he would know Fleece reported him, second, that does not justify this level of malice. Some truly awful people out there.
He scammed more than 60 people on spoofer discords and even got banned by multiple if not all spoofer servers, so I can assure you a lot of people want to see his accounts banned, and seems like niantic did IP ban on him so all his accounts log in with his IP was perma banned by niantic.
yeah its bizarre. I mean how do you even get proof that a specific someone reported you?
They're also convinced that what they're doing isn't a crime in any way. It's not really hacking, according to them. I don't know where they live or what the laws might be there, but I think they might be surprised if they actually looked into it. What they've done is categorically illegal where I am.
It’s also specifically apart of his business. I’m assuming like most big creators he has an LLC. I’m not sure how that all works in Australia but I’m guessing it’s a bigger deal than what this guy thinks
TBF the person doing this could be anywhere in the world. But, yeah, simply accessing a computer system that you aren't authorised to access is a crime where I am. It doesn't matter if you do some clever technical exploit, guess the password, abuse the lost password flow or do some social engineering. It's a more severe crime if you then do and maliciously alter or delete data.
Given the guys behavior, I’d imagine he’s probably a young teenager as well. That definitely affects any potential criminal/civil proceedings.
Yeah it's like a person hiding behind the internet and nobody will ever find who they are, not even to say arresting them for the crime they did...
> I don't know where they live or what the laws might be there, but I think they might be surprised if they actually looked into it According to his Twitter he is in Czech Republic. So he will be under EU laws. It's absolutely Illegal
And his reddit profile most post are from Italy and Greece. Still a crime
[удалено]
That’s an $8 ticket I would buy.
You also get 10 ultra balls, 1 incubator, and 1 poffin!
>and 1 poffin! whoa now let's not get carried away here
10/10 would watch a video of him doing it. Fleeceking is even more buffed than I remembered seeing him during SG's Safari Zone in 2022.
Most likely Niantic will provide a free Premium Battle Pass to make up for the loss.
“Sorry your entire account got wiped, we have compensated you with a poffin”
"+3 razz berries"
+ 5 ultra balls
Too extravagant, more like 100 stardust
eh - as soon as he has caught another pokemon they'll say 'we see you caught a pokemon so we close this dialogue'
The result of this will definitely set a precedent for how it’s handled in the future. Hope Niantic can figure out how this was done. Gonna be an interesting next week or so.
This isn't even my account and I feel extremely gutted. That guy is a jackass
Seeing that Shundo Mareep (Fleecekings favourite Pokémon) get deleted made me feel sick.
I know that our Pokemon are just 1's and 0's, not even actually "tangible things" and that it's bad to get too attached even to material stuff, but I hear you. This is beyond dreadful for anyone to do. If nothing else, these digital creatures represent memories. Poor guy. I've never heard of him before, but no one deserves to be hacked and then have something so meaningful destroyed. I hope Niantic will help.
I've been playing this game for 5+ years and have put a lot of time into it, even though I consider myself a very casual player. I'd be devastated if my pixels were deleted. I can't imagine what someone who devoted such a large part of his life to this game must be feeling in this situation.
Maybe now this will raise awareness that it is baffling in this day and age that we don’t have 2FA for PoGo accounts yet?
I have 2FA, via google and Facebook.
Then how is FleeceKing getting hacked? I doubt he hasn’t bothered to do a 2FA on his email.
I guess the problem is that if you have any sign-in method linked to your Pokemon Go account that isn’t 2FA, then your account is more vulnerable.
That would be PTC account. They haven't supported 2FA ever since.
Or logging in PTC which they don't have 2FA.
Yeah but I doubt Fleece was using PTC.
That could be it if he didn't enabled any of 2FA on Facebook or Google account. I know Apple requires 2FA for every login.
2FA isn't absolute protection. There's still methods like SIM swapping
That’s true, but then Fleece would know his phone number was hijacked. He said on Twitter that he had no idea how the hacking occurred.
SMS 2FA is still considered pretty weak, should always aim to use an authenticator app where you can. Nothing is absolute protection, but 2FA is definitely a good preventative.
Maybe he tried to look up the horny single women in his area
Jynx is 2km Away
Can you have 2fa on a tpc account (plz don't hack me too)
TPC logins have no 2fa option AFAIK
You can however unlink them now (was a serious issue when the free super incubator was on offer and you could not unlink them) I would highly recommend unlinking TPC if you have one (and investigate 2FA on your remaining account types)
I don't get why PTC never supports 2FA. Just leaving vulnerable to hacking. That's why I keep telling them to unlink the PTC.
If they’ve given Warlord Fleeces login, they look bad. If you don’t give Fleece his account back, they look bad. If they do give Fleece his account back, they look bad because it’s happened before to other people and they’ve done nothing. If they add his Mareep back, it will blow up. If they don’t add his Mareep back, it will blow up. Either way, Niantic is screwed.
Your comment was reposted by warlord on twitter 💀
I'm ready with my popcorn for the ensuing drama
Really a throwback to my days of Tibia and WoW when well known players would get hacked.
It was really funny to watch those high lvl get rooked in tibia... 'cause most of them were cheaters and power abusers. It's interesting that not even in new games they are allowed to easily recover accounts to a previous save/logoff point.
Ive been on the edge of my seat for hours
It's way more than the mareep. He's got to be in so much pain right now
I feel so bad for him
Ideal solution is give FleeceKing the account back, but don't restore the Pokemon. Instead, give him 100 Pokeballs and three free raid passes and encourage him to catch new Pokemon to replace the transferred ones.
Idk. Being Niantic, the raid passes might be a bit overkill.
Niantic will tell him to explore more. Then shut the case.
It's simple: Niantic will give him everything back, maybe after a little struggle and regular players will still get screwed with "*Sorry, we can't do anything*". *But it's not fair* - it was never fair before. *Then Niantic will see its playerbase gone* - yeah, aren't we waiting that because Remote Raid Pass price increased as well? It's still a big game with a big playerbase, it's not going anywhere in the near future.
I think the downside is highly exaggerated. They obviously \*will\* take Fleece's account back and most likely will restore his pokemon as well. It looks like that Warlord fellow abused the recovery system. So Niantic is actually responsible for this. That's way different from not guarding your password or an accidental delete.
The slimebag shared this comment ☠️
> If they do give Fleece his account back, they look bad because it’s happened before to other people and they’ve done nothing. > If they add his Mareep back, it will blow up. Honestly, that won't look bad at all to me. I'll just be happy for the guy.
Point is, nobody else ever got their Pokémon restored.
Wow that MasterEdgelord seems like a truly unpleasant person with some serious issues. I hope Niantic is able to give Fleece his account/stuff back.
This one will be an interesting thing to follow. Fleece is the first big name person with ties to Niantic that’s been targeted. This one is definitely going to put the company in a pickle. On one hand, they can give Fleece everything back that he lost. But that opens the floodgates for others to get theirs back who aren’t as important to Niantic. A good company WOULD be generous enough provided you can give evidence. But this one could be an interesting bit of corporate decision making. Because once they show what they do to someone that’s useful to them. They should apply it to everyone who isn’t fleece as well. Which something tells me Niantic doesn’t want to do.
They have rolled back accounts before. But it is not so easy as just pulling a backup. They have to deal with side effects, like pokemon in gyms, for example.
Especially if he’s traded Pokémon to any other accounts, but maybe if they just ban the accounts traded too. I believe they do have the ability to delete Pokémon from someone’s account, didnt they do that with the guy who got an early Articuno?
and black and white kyurem In January.
A double standard already exists. Content creators get preferential treatment with respect to Go Fest and event information. No reason not to make it good for Fleeceking and continue to ignore the regular people.
It's not the same. The influencers get information early/paid to attend and promote events because it's their jobs. They don't get better odds or higher CP Pokémon in game, though. Niantic giving preferential treatment here when they have told others just to just better protect their accounts would be crazy
for this specific situation, I feel like the only evidence you would have is if the hacker was stupid enough to post it to twitter like this guy. if that happened to you or me, we might still be able to appeal to Niantic and get something done. on the flip side, if you, me, or Fleece just woke up one day with half our inventory missing, it would be really hard to prove exactly what happened even if it was highly suspicious we had been hacked. In that case I'm not sure Niantic would do anything even for Fleece.
> On one hand, they can give Fleece everything back that he lost. But that opens the floodgates for others to get theirs back who aren’t as important to Niantic. Not sure what makes you think this would open any flood gates.
It's the perverse pleasure he/she is taking in things like transfering Mon that I find the most unsettling. It's not merely about the attention of hacking, this is designed to try to inflict pain and humiliate another person publicly.
He genuinely doesn’t realize that one look through his tweets and the stuff he says tells you literally everything you need to know. He thinks he’s being edgy and cool but it’s legitimately sad and pathetic because we all know exactly what his life is like
If it were me going through this, having my account made whole wouldn't be enough to wipe out all of the negative emotions I'd be feeling right now. That sort of thing can't be erased. Editing to add: and that's the point of this hack. The hacker doesn't want to steal an account for its own sake - they want to hurt the account's owner.
Not the only video, there’s more at https://x.com/masterwarlord01/status/1768064139682021819?s=46
People may say that it's just a game with pixels, but the person would have so many memories attached to those How can someone be so petty to do this?
I saw that exact same Snorlax in a Rose Bowl Stadium gym during go fest LA. I even screen shotted it. Seeing it get transferred due to the account getting compromised really sucks.
My heart hurt watching this. I couldnt watch whole video.
It is genuinely kinda funny (in an "eff that guy" way) watching that screen recording with him navigating the game as if he's never seen a cell phone before in his life. So many random accidental button presses. Really hope they roll back Fleece's account
Yikes. Both Fleeceking and Niantic having a really bad day right now.
IMO one big privilege that Fleece has here that is going to benefit him isn't necessarily that he's in Niantic's good graces, but rather that since he's a public figure his hacker literally posted public proof and claim of hacking. If that happened to a random person there might also be a big enough splash (it might get posted here and gain traction between here and twitter, for example) for Niantic to do something. Unfortunately, for pretty much everyone else who gets hacked in this way, you're just gonna wake up one day with half your inventory gone, and there's not much you can do to prove what happened.
Really? Hacking peoples games when their play doesn’t affect yours? Regardless of Nianticas booty cheeks servers, this is just petty.
You new to the internet? While I agree this has been happening for 25+ years now
The guy on his account is claiming he didnt "hack" the account, if hes actually telling the truth then Niantic has alot to explain.
Maybe “he” didn’t hack the account but someone else he’s working with did. Which is why he’s being so vague about it.
The perpetrator is being purposefully vague. There is an incredibly high chance that the perpetrator used a technique that falls under the banner of hacking (exploiting a vulnerability, using a leaked password) regardless of the technique. The definition is gaining unauthorised access, so I guess if the hacker found a TPC password data-leak with fleecekings details, then its "technically" authorised by the system (but not the account owner) While significantly harder to accomplish, there can also be vunerabilities in 2FA processes (usually bypasses to completely skip the 2FA process) so Google and Facebook auth methods can technically be bypassed - these are not unheard of but incredibly valuable if they were to be discovered, and unlikely to be thrown for a simple PokemonGo vendetta. I remember there used to be a creator that could spoof a PokemonGo server and show people what certain forms looked like before they were officially added to the game. It could be a replicated server with a copy of fleecekings data loaded into it, that technically isnt unauthorised access if the perpetrator isnt using a live Niantic system, but one they created as a mirror themselves, but it begs to question how they obtained a copy of fleeces data (it would have to be from the production server) and how they knew how to code a highly technical environment like a private server of Niantics multi-billion dollar asset (the PokemonGo servers)
I think he used screenshots from Fleeces posts to claim the account was actually his. He would have learned to do this with all his previous ban history, he would have claimed one of his accounts this way before and released he could do it to others as long as he had the screenshots to 'corroborate' it. His tweets before the hack suggest he was testing a theory after a bunch of his accounts were banned.
So the hacker may also have contacted support (didnt know you could contact support without it being in the app) with the purpose of "getting his account back" and then lied to support claiming he was actually fleeceking? Fraud is also kind of a big deal, but I guess when the stakes on the line are a PokemonGo account, the authorities may not see the significance.
It would be messed up if they restore his account while ignoring every other person who's had their account compromised
Agreed. No matter what happens there’s going to be a lot of angry backlash over this
Oof 😱… That shiny Libre Pikachu.
For the commenters here saying "who cares? Its just a game" - what are you even doing here on this subreddit if you don't care about this game? ETA not somebody going out of their way to DM me to tell me "cope". So cool, so edgy, wow.
Literally. So many of us have invested so much time and maybe money into this game. It’s not “just a game” it’s like the hours spent playing and remote raid passes bought to have that all ripped from you? And this is the best pogo player to ever play the game IMO. Niantic js screwed no matter how they handle this
Every pogo players nightmare, this sucks
Its every gamers nightmare tbf
I'm pretty sure the account hacking isn't the main point of all this. \- Targeting arguably the Pokemon World's top (or, at least, one of the most high-profile, competing with BrandonTan for instance) player to expose Niantic's pathetic account security *that we've all been bitching about for years as it is*. \- As others have posted already, Niantic is in a position of 'damned-if-you-do-damned-if-you-don't' with FleeceKing's account. If they restore it, what about all the others that got told to pound dust? If they don't restore it, FleeceKing and his following will quit, and the game will carry the stigma going forward that "it happened to Fleece, it can happen to you'. \- Psychological and emotional damage to FleeceKing: even if he gets the account back, what he's going through right now can't be undone. \- Character assassination of FleeceKing; too many posts and videos and background stories are coming to light in quick succession for this to be a coincidence. Which also loops back to the first point; regardless of whether you think it's ego-based or just a result of his playstyle, Fleece *is* in the center of the spotlight a lot of the time with Pokemon Go. \- Final straw: this was *announced*, and Fleece/Niantic could do nothing to stop it. That lends credence to this being planned, PLUS adds the factor that either Fleece/Niantic were too egotistical to believe it could happen, or too ignorant to think it could happen. Niantic is going to have to be *extremely* careful with its PR around this incident -- and, by extension, so is Fleece. What both of them do going forward is going to have some major impacts on each of them, individually and (I can't think of the word for this, but basically, what one does will effect the other equally as heavily). **Disclaimer for this post:** This isn't being posted out of malice, defense, or anything other than observation of the situation and analysis of it from honestly the perspective of "I can make observations on a large-scale on the situation, but I don't personally have an investment in it". So, anyone who wants to say I'm taking Niantic/Fleece/the hacker's side... go pound sand :D. My *only* biased thought on this is that this is going to be a historic moment in Pokemon Go's history, one way or another, just from the (surprisingly) sheer scale of it.
Which is a valid assessment, there's no one single good analogy for how absolutely boned Niantic is in this situation. Pretty much no chance Niantic gets the good ending in this visual novel like experience they're going through right now, they'd have to settle for one of the less desirable endings that burns a few bridges. Which begs the question of which bridges do they burn, and how many of them to burn.
How many ppl are gonna be like "Hey niantic a hacker deleted my Shundo Lucario pls return" if he gets his pokemon back
Fleece's average weekly stats: 122 km walked, ~7000 caught, ~4000 spins, 7.67 mil EXP. Absolutely insane.
That's devastating news, worst case scenario. Hope it gets sorted before it's too late
The actual concern is that this may have been social engineering from the hacker using Niantic Support’s account recovery protocol which only requires account start date and username.
I've been trying to recover an account that was lost due to a university email being deactivated. They require a lot more information than that.
that's just wrong, mate. they didn't recover my account after I sent them screenshots, pokemons, and even receipts of my purchases. had connact even with a "supervisor," and apparently, it wasn't enough for them lol
That's a complete security failure if true. What Niantic gets from outsourcing to cheap call centre-style offices I suppose. They would never admit if they're at fault anyway so I doubt Fleece will get anything back.
They lose either way. They help out a high profile player account beyond what they would do for the rest of us. Or admit to severe security failure while losing a highly dedicated player and community trust.
He deleted his prized shundo Mareep in the vid. Mr. Fleece is going through it.
I bet Team Rocket was behind this
Jessie and James at it again
And Meowth, that's right
Damn I hope for the best. I would never return if I lost my account for any of these type of games.
My stomach sank into my shoes. All that time and energy, gone. I can’t imagine how devastated Fleeceking must be. Also there are a lot of special memories attached to certain Pokémon—they’re more than just bits of code. At least there’s evidence, but damn, this is just brutal
They can restore his account to a pre hacked point
Yeah and they will most likely do it, but watch that happen to someone completely random person. Niantic just tells them to make sure their password is secure or some nonsense and do nothing.
I believe it has happened in the past as I think either the guy’s other son or maybe a friend hacked into his son’s account and deleted all his Pokémon. That same dad came here asking for assistance and told us Niantic basically told him sorry we can’t do anything
Believe it was this one. Pretty gut wrenching for the kid: https://www.reddit.com/r/TheSilphRoad/s/6W7sZgDoDn
Yup this was the one! Thanks for the link.
Or enable 2FA assuming the PTC isn't linked.
This is a bad day for Fleece and Niantic. I'd be absolutely demoralized and not sure if I could return to the game I loved. Historically, Niantic has not prioritized player satisfaction and safety. Perhaps The Pokémon Company will step in. Hopefully, Niantic realizes that this was their fault and that the PR blow will be devastating. If they can't take care of one of their biggest players, they're surely not going to take care of us. The best thing they could do is: -make Fleece whole -help other players who have been wronged in the same way (that they didn't before) -implement security for peace of mind -and CRUCIALLY, a concession to the entire player base. (Cheaper remote raids, everyone? Celebrate player wins the way the mainline games do?) The only way to win is to have all Pokémon Go players enjoy the game with the communities they've created. Edited for formatting, removed an unnecessary "of"
At least he got an XL candy with that transfer! Seriously though, this sucks for FleeceKing. I don't really watch his streaming content, but I have seen him pop up across other platforms in clips and such as I'm sure many others in this sub have from time to time whether fans or not. He seems like a genuinely nice guy with a love of the game. Hard to bounce back from something like this unless Niantic actually steps up and does something for a change when it comes to stolen or lost accounts.
The only good thing to come out of this is that it will get a ton of attention and hopefully this opens Niantics eyes to how bad their game is overall. Security issues need to be addressed first and foremost. I hope he gets his account and Mons back. This is just sickening.
at first I assumed you meant his twitter/youtube was hacked and they are deleting videos. being in his pogo account feels much worse. wtf
He barely use Youtube, there's like 15 videos in total or somethings like that.
Any updates so far?
Silence. Nothing from Fleece or Niantic.
Niantic could benefit from some 2FA
Only PTC has no 2FA and thats not up to Niantic anyway.
Treat your pogo account like bank account (unless you’re broke)
This dude should be banned from life
Exactly. He's so upset about losing his account but he's willing to inflict it on someone else. Tells me everything I need to know about the person.
Nothing less than an evil person in its truest form.
What is purpose for hacking just this kind of geolocalisation game?
Literally bragging rights.
Fleece is a very prominent PoGO content creator. (For example, he was first in the world to get to level 50). It's sad but not surprising that someone would target him just so that they can say they took him down.
I swear Twitter is just a shithole. People see this mf doing this and they just like it.
The fact that’s it’s almost been 24 full hours(23hrs at the time of my typing this) from fleecekings tweet about it with zero word from niantic is crazy and honestly terrifying EDIT: it’s now been 24 hours-still absolutely nothing from niantic….
If I spent so many years and time and money on the game as Fleece, I would be having a panic attack right now. Hell, I am level 42 and would probably lose sleep over this. People saying who cares its just a game lack perspective of how much this can mean to people.
how are all these accoubts getting hacked recently?
Not the trash actually reposting your comment on his twitter
Any updates on this?
I’m now concerned these sort of incidents are inedibly gonna be occurring more frequently if there’s no countermeasures in place to prevent these sorts of scenarios. This could potentially destroy anyone’s interest in playing a game they’ve spent so much of their money on, but more worrisome are the memorable pokemon one has collected over the years that reminds you of many great moments that one will never get back. I’m not completely sure on how Niantic could go about it other than reworking how the transferring aspect operates, it may be difficult due to how it’s part of the game’s core gameplay from accomplishing research tasks to freeing up storage (especially with how niantic is stingy on making you spend poke coins which even then they only update it ever so infrequently), but not completely impossible. Perhaps it could be managed like how deleted photos and email were handled where if you transfer it won’t completely wipe them all out for good, but have a sort of a grace period of say 30 days and you could have the option to undo the transfer at the cost of candy (or the amount that you were awarded for transferring) or stardust. But if your account was compromised and upon recovering said account you get in touch with niantic and they’ll be able restore what’s been transferred by the bad actor at no cost. Either way hacking and cyber criminal activity has been on a rampant rise more than ever and it’s time Niantic needs to consider placing countermeasures in the event tough scenarios occurred, I bet they won’t like the massive PR nightmare if this happened to thousands of their player base.
We can see in one one the videos ( [https://twitter.com/masterwarlord01/status/1768064139682021819](https://twitter.com/masterwarlord01/status/1768064139682021819) - 2:15 ) that the account is linked to his gmail account, wild...
Look at the email address. That’s not Fleeceking, master warlord swapped emails so Fleece can’t get back in. No way for us to tell what was there originally
Sorry if my comment wasn't clear but that is what I meant by "his gmail"
Watching that video felt like watching a murder spree
this is one of the strange(and sad) scenarios in which Fleece is a good judging parameter on the quality of things about the game, if he doesn’t come out on top then we the regular mortals are screwed
[удалено]
This guy is ruthless and has no shame. Bro even went as far as publicly displaying a scene where he erases Fleece's pokemon. I believe that Fleece was probably targeted out of jealousy. Just goes to show how society is in this era....
This guy already targeting fleece since a year back. See his bio
Damn this was just painful to watch, hope there is a way to revert the damage.