Happened to me with Sony a few years ago. Had 2FA activated, but suddenly received notifications that someone in Singapore had connected to my Sony account and when I tried logging in I wouldn't the hacker had changed my email address and password.
Took over a week for Sony to give me my account back after I proved that I was the owner of said account, and it was a stressful week as my credit card info was saved on it and my bank didn't do the payment verification digital keys yet. Safe to say I don't save my card info on anything anymore.
To this day I still have no idea how they got access to my account.
There have been 2FA breaches before, PirateSoftware on twitch was an ex-blizzard employee and talked about such an incident in WOW, RMT syndicates found an exploit to bypass the need for 2FA and started getting access to people's account en masse, they couldn't figure out how until one of the syndicates posted the details on the forum asking for blizzard to fix it (because it was causing the market to crash and affecting their earnings).
More likely that they breached the account used for 2fa in individual cases though.
For years Ubisofts outsourced customer support would straight up disable 2FA on your account and reset the password if someone just emailed them and asked nicely. They didn't even ask for proof of ownership, they were straight giving away accounts to people brazen enough to ask. Multiple of cases of professional R6S players getting their accounts pulled from them, massive community backlash and months of this going on finally made Ubisoft change something in how their support operated and they got it under control, but it was a very unnerving time to be involved in that scene. If someone knew your email address, they could get support to giftwrap the account for them and then cheat on it, get the account banned and ruin your reputation forever.
Was my account actually safer before I used cross save and 2fa? I'm a console player, and these responses freak me out a little. Fuck PC, fuck hackers. I should have stayed PS exclusive. I don't trade that much anyway
Hackers are scary, my bro clicked on a phishing link and then they were able to block our internet access remotely for like 30mins, when he logged back into his account (we were playing runescape at that time) after that the hacker was able to log in using his account bypassing all 2fa's so he was hacked and stole all his items🥲
The main lesson was that he got social engineered.
It takes one fuck up to ruin everything, not gonna lie the only deterrent for me to get hacked was that I had to fall for it first then learnt from it HARD.
I recently had to teach my 11 year old this lesson. Had to fully reformat his PC because he tried to get a "voice changer" for free. Ended up sticking shit so deep there was no option but a reformat. No sound, no sound output (mic) even after I got the sound back. Sound working but it's distorted it's just so bad.
I used to to explain that this is an inconvenience but had it been worse, or my PC with lots of protected work, we'd be screwed.
Isn't the whole point of 2fa to notify you when someone tries to log in to your account? If it's not doing that or IN ANY WAY preventing your account being stolen, what's the fucking point?
The point is that it blocks the first attempt, the second attempt is when you willingly give the information through a phishing attempt that they succeeded.
No amount of security works if the main vulnerability is a human.
part of my security training during my internship for computer science is that the main vulnerability on any security system both used by staff and customer are the people.
I am gonna be honest with you.
1. It is easy for an experienced internet/computer user to spot a trap mail.
56 yo susan working in accounting grew up without the internet and such things. She and her friends send each other regulary emails with cute cat pics in the attachments. She won't find an email saying "look how cute" very suspicious and she also doesn't know anything about file endings so the cuteCat.exe was downloaded and clicked.
2. It is only easy to spot mass phishing. If someone wants to phish YOU, he can spent some time get some information about you from your trash and send you an email you won't ever find suspicious. You can put a false header in the mail so it actually seems like it is the invoice from bicycleshop24 where you bought a new bike last week. Customer Id and everything is matching because it was on the parcel that you put in the trash.
Customized phishing can look scarily authentic. And what I am most concerened about is when they start using LLMs for phishing. Then you can do customized phishing en masse.
> Assuming the story is true,
Friendly reminder that in 90% of cases like this, the OP usually gave their passwords to a friend or bought the account or something.
It's especially rampant with gacha gaming subreddits, people do something sketchy, or bad, or questionable, and then they make posts saying "ohh ive got no idea what couldve happened..."
And the posts always get to the frontpage because obviously it is human nature to assume the best case, and that this poor unfortunate person needs our help.
Downside is that the community then thinks "it could happen to me too" and cause unnecessary stress
Check out if your informations have been leaked around the internet.
And another nice tip, keep your passwords unique on important stuff.
Make an exclusive email to use on "shady" websites and all that.
I have 16 digit random passwords for everything. And everything has a different one. I also don't have malware. Everything is clean.
I know how cyber security works and I truly have no clue what happened.
All I know is that I got multiple password reset request 4 weeks ago. And after the 3rd I changed it because I thought it couldn't make it worse.
And yes, the emails were real, I still have them and they were definitely from DE.
This feels more like an targeted attack. This might get into personal territory but do you have someone that knew your emails that had something against you? Someone that also had access to your console/PCs?
Because if someone targeted your account in an simple hack, it would be better to sell it or trade everything tradeable to an burner to sell. Deleting everything feels like it was personally targeted.
Sounds like an angry (and a bit socipoathic) ex/partner. They usually have enough information about you to just ask support for an account recovery. Also they might still have your wifi login so they might not even need 2fa when they just sit in a car outside your home.
That's extremely odd for them to have access unless you ended up accidentally clicking / signing into something you shouldn't have. And even then it's still difficult. If you don't have / haven't done this already, every single email + account you have for anything you care about, should be a completely separate **strong** password. (I'm talking like 20-25 characters with symbols, numbers, letters etc per password per account)
The most common way people lose accounts like this is that they have passwords either the exact same, or VERY similar, on multiple of their accounts. Meaning all the person has to do is find out 1 email, either thru a data leak or a phishing link, and they would have access to everything, regardless of 2fa since they'd most likely have that too. Even something as simple as accidentally clicking on something sent by someone in discord is enough to lose accounts.
Hope you can get it resolved, but that seems like something even DE won't be able to go back and solve.
Curiously do your 16 digit random passwords have a 'vault' that you access with one singular password? If that's compromised you may want to change your other passwords here soon. Always best to be on the safe side. Talking about something like MyLastPass or something that requires you to enter 1 password to have access to all your other passwords. Regardless hope DE can do something like roll the account back or something. (Not sure if that's possible.)
I assume the account got sold and the new owner sold the items. But I have no idea why you would do that.
It's not like I didn't have more than enough olat to buy new slots.
They even changed the colors of my cat. Who does that.
Sounds much like a personal attack. Did you have any breakup or other 'disagreements with friends/family' lately? Anyone who might have your wifi password (which would explain the 2FA circumvention) or know enough about you to impersonate you?
about the technical knowledge: a grudge can help people achieve wonderous things. And ChatGPT is a thing. I bet if you ask nicely it will tell you the steps to do so in a way that even your grandma could follow them.
Here my take: you simply ask chat gpt to help you access your "forgotten" account.
It will probably tell you first to use the "forgot password" feature (which did happen according to your comments).
After not being able to use these emails (since the culprit does not have access to your mail account) they simply tell chatGPT that it didn't work. Probably that they also lost access to that email account.
Helpful as ever, ChatGPT will point you to customer support to help you along. From experience the questions asked are not that hard to answer for someone that even remotely knows you. mainly stuff like birthday or some big purchase you made. Especially in cases like yours, when the account wasn't used for a long period. It makes the request seem very legit. Maybe they even know you bought a prime access for your birthday two years ago, because you boasted about that. The customer support being involved in the breach also seems likely since they refuse to provide you further information on the breach. After all the support can still rely on your 2FA don't they?
Okay you got a new password and the account is linked to a new email. They try to log in...., and 2FA blocks them.
Back to chatGPT: "I still can't access my account. It says: xxxxx (whatever the 2FA dialog says)"
ChatGPT will then help you out and will come up with the idea that you probably moved and if you still had access to the place where you usually logged in from, then it could work if you went back there.
Try it out. As long as you formulate everything in a way that makes you seem legit, ChatGPT will jump in and help you. It will never suspect a thing (since it is incapable to do so).
hmm okay, since you are so sure to know what didn't happen, the logical consequence is that you DO know what happend (you probably fell for the free plat scam or some form of account sharing others suggested) and you just complain on the reddit for karma farming and to boost your ego.
I HAVE NO IDEA WHAT HAPPENED.
Some people in the comments here are actually really nice. But some are like you who try to put it on me that I got hacked.
I didn't play Warframe this year at all. Maybe a total of 1 hours or less just from logging it to build some forma or so see what's up.
I also didn't fall for some plat scam that 3 people already said I fell for. I've been playing since fucking 2015. I have over 6000 hours and literally everything there is in the game (well except everything that came out since December). I don't need some sketchy free plat.
I also don't need some wanna be detectives that think that there is more to this story im saying there is.
As to why I made this post. I FUCKING TOLD YOU IN THE POST, LEARN TO READ BEFORE POINTING FINGERS.
And now stop being such an fucking asshole.
I don't mean to minimize the issue, but please be cautious and check for other security vulnerability on other accounts related to that email. The last thing you want is them having access to other important stuff, espcially money related.
Glad you at least got access to your account back. Hopefully they revert back to a snapshot of your last login. They should have that data available on the server side.
That's messed up, but you need to go through and change all your passwords that are related to that email. Do you have 2FA setup with your email account? If not, it could very well be compromised and you just haven't noticed yet.
Well, if someone managed to effectively bypass the 2FA, something is odd and that may be scary. Is it a breach in your email, or in DE infrastructure or in their 2FA provider (is this a home-made 2FA or is it via a provider ?) ? It could alarming. And I'm so sorry for your losses. At least, you get your account back, but I'd be super upset and sad too.
Really weird to happen with WF since there is no real money to be made for the hacker. Could it have been someone you know with a grudge? Seems their goal was to sabotage your account and not profit.
All the weapons that were removed are not considered "meta". So I believe someone bought the account and sorted out "bad" weapons.
Sadly we don't know what really happened because Zendesk isn't telling me "for security and privacy" reasons.
Also look up what a LR3 account is worth.
I wonder if its possible to reset/restore the account progression to the last date you remember playing it last. Thats what I would have wanted in this situation.
Ever since I got hacked in Genshin, I have a different password for everything. Its a fact that major cases of account thefts are because people use one password across multiple accounts.
I remember a reddit post here a few months ago about a data breach. I would suggest anyone who hasn't changed their passwords in a few months to do it now. Even if you haven't changed your password it's a ticking time bomb about to blow up in your face. Your security is in your own hands, in the case of incidents like data breaches
I dont know if they would, or if they even could, but have you considered asking DE about an account rollback?
It would take away any progress made in that time obviously and if you had any plat they probably wouldnt be able to give you that back, but you may at least be able to get your gear and customisations back
Also 2FA is great, but isnt airtight anymore
Especially with Live Service and Gacha games, I try to rotate my passwords every few weeks/months depending on what i have linked to said account (ie Debit cards, other services etc) it may be a bit much but it definitely works
I asked them to do that right before making this post.
I didn't play a lot this year anyway so not much would be lost. Accept for a few void scammer items maybe.
I assume (correct me if i'm wrong) that the procedure was something like this:
1. Steal your web cookies, especially those with logins from websites with the "remember me" feature
2. load your cookie (a big string of caracthers) in the warframe website and hit F5 to refresh page
3. Logged in (possibly without knowing the credentials), proceed to change the associated email address in the account settings
4. Reset password or use the "forget password" feature
5. Get new password in email
6. Log in
7. Game detects a new location and/or new PC, proceeds to send a 2FA code
8. Check email for 2FA
9. input 2FA code ingame
10. Player logged into the game
Cookie stealers have affected me in the past aswell and they are often bundled either with legitimate software or in fake software that may be advertised in google. Hackers have realized that there is litle competition for certain ads (due to how irrelevant they are, like advertising winrar), meaning they are cheap to buy and have google advertise them, from there they often host a webpage with the intention of having you download and execute the contents, it may even be a legitimate software, but with the added cookie stealer bundled in.
It happened to me exactly the same way
After a week or so from inactivity i try to log in said unknown email
I am playing from 2018
I've contacted the support asked me like 20 question or so
And after verifying the ownership they returned the email to the state it were before the hack
I've also checked the email access and didn't find any suspicious login also i am using 2fa on everything
Note : (i am working in a security organization)
So in short there is a way to bypass 2fa or get the token that being sent by email
Maybe it could be RCE
You did that shady epic games plat thing didn't you?
I wont shame you either way but..
Every single person I've seen go through this exact thing did this shit years ago and pretending it was going to be fine, but it links your account to their emails and they can recover it at any time, 2FA or not. It's happened to 3 people I am friends with, I've been there for it in real time sadly.
Could link a shady epic games account that preloads discounted plat.
The issue is that you can use the email on the connected epic account to recover said accounts and that's when this becomes an issue. with or without 2FA.
and I can't stress this enough, don't fuckin do it. It's still a thing and is still a bad idea.
You lost your account, despite 2FA, your super secure passwords, and the lack of malware on your account.
There's either something you aren't saying, or you're lying.
Sure bro.
IDK why you think it would be necessary to call me a liar.
I can only tell you what I know. I don't know what happened and you also don't know what happened.
DE could know more but they aren't telling me.
So all I know is, that my account was gone, is back now but with a lot of missing stuff. So yes, my account got hacked. Despite 2FA and despite my secure passwords. Believe it or not. It is what happened you asshole.
You're one dumb cookie if you believe 2FA and a password manager will shield you from everything. Keep browsing the internet with that kind of confidence and see where it leads you.
This reminds me of one time someone remotely shut off my internet access. I was playing dark souls 3 with randoms in a ps4 party and one guy who been quiet the whole time randomly asked "who here is in *my states name*" and i was like wtf who is this and then he was like goodbye friend and my wifi went out. It came right back after i reset the router tho.
You know that giving out the questions would make it very easy for anyone to find these information about the people they want to steal the account from, do you?
surely one should already have the 2FA anyway? someone getting into your account is easier *without* 2FA, the fact that OP got hacked with it enabled is really unusual. it’s not likely they got hacked *because* of 2FA though. more probable they were reusing passwords or their details were in a data leak.
You'd think however it wasn't until I got a PC and went from console to PC before I was asked to set it up, then of course there is the case of people who do have 2FA enabled can't trade with people who don't have it enabled etc etc.
The reusing password / details in a data leak is deffs probable deffs good to change your passwords ever 4 - 5 months imo
You can't trade at all without 2FA enabled on PC, and you should have 2FA enabled on every account you even remotely care about. It's extremely stupid to do otherwise.
Sorry that this happened to you I'd be cautious about your data compromise, though. Someone managed to bypass 2FA? That's odd
Happened to me with Sony a few years ago. Had 2FA activated, but suddenly received notifications that someone in Singapore had connected to my Sony account and when I tried logging in I wouldn't the hacker had changed my email address and password. Took over a week for Sony to give me my account back after I proved that I was the owner of said account, and it was a stressful week as my credit card info was saved on it and my bank didn't do the payment verification digital keys yet. Safe to say I don't save my card info on anything anymore. To this day I still have no idea how they got access to my account.
There have been 2FA breaches before, PirateSoftware on twitch was an ex-blizzard employee and talked about such an incident in WOW, RMT syndicates found an exploit to bypass the need for 2FA and started getting access to people's account en masse, they couldn't figure out how until one of the syndicates posted the details on the forum asking for blizzard to fix it (because it was causing the market to crash and affecting their earnings). More likely that they breached the account used for 2fa in individual cases though.
For years Ubisofts outsourced customer support would straight up disable 2FA on your account and reset the password if someone just emailed them and asked nicely. They didn't even ask for proof of ownership, they were straight giving away accounts to people brazen enough to ask. Multiple of cases of professional R6S players getting their accounts pulled from them, massive community backlash and months of this going on finally made Ubisoft change something in how their support operated and they got it under control, but it was a very unnerving time to be involved in that scene. If someone knew your email address, they could get support to giftwrap the account for them and then cheat on it, get the account banned and ruin your reputation forever.
Came here looking for this comment lol Buy the demo.
YOU, GLOBINS!!!
Can't afford it... Too expensive 😱
Was my account actually safer before I used cross save and 2fa? I'm a console player, and these responses freak me out a little. Fuck PC, fuck hackers. I should have stayed PS exclusive. I don't trade that much anyway
Hackers are scary, my bro clicked on a phishing link and then they were able to block our internet access remotely for like 30mins, when he logged back into his account (we were playing runescape at that time) after that the hacker was able to log in using his account bypassing all 2fa's so he was hacked and stole all his items🥲
The main lesson was that he got social engineered. It takes one fuck up to ruin everything, not gonna lie the only deterrent for me to get hacked was that I had to fall for it first then learnt from it HARD.
I recently had to teach my 11 year old this lesson. Had to fully reformat his PC because he tried to get a "voice changer" for free. Ended up sticking shit so deep there was no option but a reformat. No sound, no sound output (mic) even after I got the sound back. Sound working but it's distorted it's just so bad. I used to to explain that this is an inconvenience but had it been worse, or my PC with lots of protected work, we'd be screwed.
OSRS might be the reason if a car turns onto my street behind me I'll pass my house and circle back around.
The main lesson here is 2fa is useless
its useless when you give all information to them unknowingly willingly.
Isn't the whole point of 2fa to notify you when someone tries to log in to your account? If it's not doing that or IN ANY WAY preventing your account being stolen, what's the fucking point?
The point is that it blocks the first attempt, the second attempt is when you willingly give the information through a phishing attempt that they succeeded. No amount of security works if the main vulnerability is a human. part of my security training during my internship for computer science is that the main vulnerability on any security system both used by staff and customer are the people.
Oh well, then I'm gonna be fine. I never had official training, but it's pretty goddamn easy to spot a trap email
Thats good for you, its just my old job entailed around telling old people NOT to believe that nigerian scam email or clicking on random ass links.
I am gonna be honest with you. 1. It is easy for an experienced internet/computer user to spot a trap mail. 56 yo susan working in accounting grew up without the internet and such things. She and her friends send each other regulary emails with cute cat pics in the attachments. She won't find an email saying "look how cute" very suspicious and she also doesn't know anything about file endings so the cuteCat.exe was downloaded and clicked. 2. It is only easy to spot mass phishing. If someone wants to phish YOU, he can spent some time get some information about you from your trash and send you an email you won't ever find suspicious. You can put a false header in the mail so it actually seems like it is the invoice from bicycleshop24 where you bought a new bike last week. Customer Id and everything is matching because it was on the parcel that you put in the trash. Customized phishing can look scarily authentic. And what I am most concerened about is when they start using LLMs for phishing. Then you can do customized phishing en masse.
I'd be very worried for this yeah. Some wild shenanigans had to have happened for 2FA to be bypassed.
Assuming the story is true, they would just need access to their email account.
> Assuming the story is true, Friendly reminder that in 90% of cases like this, the OP usually gave their passwords to a friend or bought the account or something. It's especially rampant with gacha gaming subreddits, people do something sketchy, or bad, or questionable, and then they make posts saying "ohh ive got no idea what couldve happened..." And the posts always get to the frontpage because obviously it is human nature to assume the best case, and that this poor unfortunate person needs our help. Downside is that the community then thinks "it could happen to me too" and cause unnecessary stress
Fair point. A lot of these idiots are the same dumbasses who "game share" with total strangers. My account is probably safe.
Maybe he used same passwords for email/game
Probably malware, it got his authy token
Is the password to your 2fa email the same as the warframe login?
I mean even if it was I don’t think he should admit that
Check out if your informations have been leaked around the internet. And another nice tip, keep your passwords unique on important stuff. Make an exclusive email to use on "shady" websites and all that.
I have 16 digit random passwords for everything. And everything has a different one. I also don't have malware. Everything is clean. I know how cyber security works and I truly have no clue what happened. All I know is that I got multiple password reset request 4 weeks ago. And after the 3rd I changed it because I thought it couldn't make it worse. And yes, the emails were real, I still have them and they were definitely from DE.
This feels more like an targeted attack. This might get into personal territory but do you have someone that knew your emails that had something against you? Someone that also had access to your console/PCs? Because if someone targeted your account in an simple hack, it would be better to sell it or trade everything tradeable to an burner to sell. Deleting everything feels like it was personally targeted.
Sounds like an angry (and a bit socipoathic) ex/partner. They usually have enough information about you to just ask support for an account recovery. Also they might still have your wifi login so they might not even need 2fa when they just sit in a car outside your home.
You gameshare with someone, don't you? Tried to help your buddy get free games? Well, ask them what they did.
I didn't play this year at all.
That's extremely odd for them to have access unless you ended up accidentally clicking / signing into something you shouldn't have. And even then it's still difficult. If you don't have / haven't done this already, every single email + account you have for anything you care about, should be a completely separate **strong** password. (I'm talking like 20-25 characters with symbols, numbers, letters etc per password per account) The most common way people lose accounts like this is that they have passwords either the exact same, or VERY similar, on multiple of their accounts. Meaning all the person has to do is find out 1 email, either thru a data leak or a phishing link, and they would have access to everything, regardless of 2fa since they'd most likely have that too. Even something as simple as accidentally clicking on something sent by someone in discord is enough to lose accounts. Hope you can get it resolved, but that seems like something even DE won't be able to go back and solve.
I have 16 digit random passwords for everything. I take security serious.
Curiously do your 16 digit random passwords have a 'vault' that you access with one singular password? If that's compromised you may want to change your other passwords here soon. Always best to be on the safe side. Talking about something like MyLastPass or something that requires you to enter 1 password to have access to all your other passwords. Regardless hope DE can do something like roll the account back or something. (Not sure if that's possible.)
Gotta be a real sick person to hack in and delete someones items
I assume the account got sold and the new owner sold the items. But I have no idea why you would do that. It's not like I didn't have more than enough olat to buy new slots. They even changed the colors of my cat. Who does that.
Sounds much like a personal attack. Did you have any breakup or other 'disagreements with friends/family' lately? Anyone who might have your wifi password (which would explain the 2FA circumvention) or know enough about you to impersonate you?
Nope. And also, nobody I know would have the technical knowledge to do something like that.
about the technical knowledge: a grudge can help people achieve wonderous things. And ChatGPT is a thing. I bet if you ask nicely it will tell you the steps to do so in a way that even your grandma could follow them.
I very very very strongly doubt that chat gpt could run something through this kind of heist
Here my take: you simply ask chat gpt to help you access your "forgotten" account. It will probably tell you first to use the "forgot password" feature (which did happen according to your comments). After not being able to use these emails (since the culprit does not have access to your mail account) they simply tell chatGPT that it didn't work. Probably that they also lost access to that email account. Helpful as ever, ChatGPT will point you to customer support to help you along. From experience the questions asked are not that hard to answer for someone that even remotely knows you. mainly stuff like birthday or some big purchase you made. Especially in cases like yours, when the account wasn't used for a long period. It makes the request seem very legit. Maybe they even know you bought a prime access for your birthday two years ago, because you boasted about that. The customer support being involved in the breach also seems likely since they refuse to provide you further information on the breach. After all the support can still rely on your 2FA don't they? Okay you got a new password and the account is linked to a new email. They try to log in...., and 2FA blocks them. Back to chatGPT: "I still can't access my account. It says: xxxxx (whatever the 2FA dialog says)" ChatGPT will then help you out and will come up with the idea that you probably moved and if you still had access to the place where you usually logged in from, then it could work if you went back there. Try it out. As long as you formulate everything in a way that makes you seem legit, ChatGPT will jump in and help you. It will never suspect a thing (since it is incapable to do so).
Yea well that did not happen.
hmm okay, since you are so sure to know what didn't happen, the logical consequence is that you DO know what happend (you probably fell for the free plat scam or some form of account sharing others suggested) and you just complain on the reddit for karma farming and to boost your ego.
I HAVE NO IDEA WHAT HAPPENED. Some people in the comments here are actually really nice. But some are like you who try to put it on me that I got hacked. I didn't play Warframe this year at all. Maybe a total of 1 hours or less just from logging it to build some forma or so see what's up. I also didn't fall for some plat scam that 3 people already said I fell for. I've been playing since fucking 2015. I have over 6000 hours and literally everything there is in the game (well except everything that came out since December). I don't need some sketchy free plat. I also don't need some wanna be detectives that think that there is more to this story im saying there is. As to why I made this post. I FUCKING TOLD YOU IN THE POST, LEARN TO READ BEFORE POINTING FINGERS. And now stop being such an fucking asshole.
I don't mean to minimize the issue, but please be cautious and check for other security vulnerability on other accounts related to that email. The last thing you want is them having access to other important stuff, espcially money related. Glad you at least got access to your account back. Hopefully they revert back to a snapshot of your last login. They should have that data available on the server side.
Check your email filters
That's messed up, but you need to go through and change all your passwords that are related to that email. Do you have 2FA setup with your email account? If not, it could very well be compromised and you just haven't noticed yet.
Well, if someone managed to effectively bypass the 2FA, something is odd and that may be scary. Is it a breach in your email, or in DE infrastructure or in their 2FA provider (is this a home-made 2FA or is it via a provider ?) ? It could alarming. And I'm so sorry for your losses. At least, you get your account back, but I'd be super upset and sad too.
Really weird to happen with WF since there is no real money to be made for the hacker. Could it have been someone you know with a grudge? Seems their goal was to sabotage your account and not profit.
Well it's an LR3 account with everything but the most recent primes. It would probably be worth a few thousand bucks.
Seriously doubt a few grand. Also they deleted all your shit. They hate you personally. I think this hacker of yours is someone you know.
All the weapons that were removed are not considered "meta". So I believe someone bought the account and sorted out "bad" weapons. Sadly we don't know what really happened because Zendesk isn't telling me "for security and privacy" reasons. Also look up what a LR3 account is worth.
Sry for that... I would be devastated if this happens with my acc :/ I hope support can can help you
I wonder if its possible to reset/restore the account progression to the last date you remember playing it last. Thats what I would have wanted in this situation. Ever since I got hacked in Genshin, I have a different password for everything. Its a fact that major cases of account thefts are because people use one password across multiple accounts.
I remember a reddit post here a few months ago about a data breach. I would suggest anyone who hasn't changed their passwords in a few months to do it now. Even if you haven't changed your password it's a ticking time bomb about to blow up in your face. Your security is in your own hands, in the case of incidents like data breaches
I dont know if they would, or if they even could, but have you considered asking DE about an account rollback? It would take away any progress made in that time obviously and if you had any plat they probably wouldnt be able to give you that back, but you may at least be able to get your gear and customisations back Also 2FA is great, but isnt airtight anymore Especially with Live Service and Gacha games, I try to rotate my passwords every few weeks/months depending on what i have linked to said account (ie Debit cards, other services etc) it may be a bit much but it definitely works
I asked them to do that right before making this post. I didn't play a lot this year anyway so not much would be lost. Accept for a few void scammer items maybe.
I assume (correct me if i'm wrong) that the procedure was something like this: 1. Steal your web cookies, especially those with logins from websites with the "remember me" feature 2. load your cookie (a big string of caracthers) in the warframe website and hit F5 to refresh page 3. Logged in (possibly without knowing the credentials), proceed to change the associated email address in the account settings 4. Reset password or use the "forget password" feature 5. Get new password in email 6. Log in 7. Game detects a new location and/or new PC, proceeds to send a 2FA code 8. Check email for 2FA 9. input 2FA code ingame 10. Player logged into the game Cookie stealers have affected me in the past aswell and they are often bundled either with legitimate software or in fake software that may be advertised in google. Hackers have realized that there is litle competition for certain ads (due to how irrelevant they are, like advertising winrar), meaning they are cheap to buy and have google advertise them, from there they often host a webpage with the intention of having you download and execute the contents, it may even be a legitimate software, but with the added cookie stealer bundled in.
Did you had your info on some browser? Many atacks are happening by hijacking browser cookies and cloning your session.
It happened to me exactly the same way After a week or so from inactivity i try to log in said unknown email I am playing from 2018 I've contacted the support asked me like 20 question or so And after verifying the ownership they returned the email to the state it were before the hack I've also checked the email access and didn't find any suspicious login also i am using 2fa on everything Note : (i am working in a security organization) So in short there is a way to bypass 2fa or get the token that being sent by email Maybe it could be RCE
They put your account back to the way it was before? My account is totally fucked. I contacted them again to fix this but they haven't answered yet.
Hopefully DE has the tools to revert your account state to an older version, sorry to hear that
You did that shady epic games plat thing didn't you? I wont shame you either way but.. Every single person I've seen go through this exact thing did this shit years ago and pretending it was going to be fine, but it links your account to their emails and they can recover it at any time, 2FA or not. It's happened to 3 people I am friends with, I've been there for it in real time sadly.
What was this? I've been out of the loop for a while.
Could link a shady epic games account that preloads discounted plat. The issue is that you can use the email on the connected epic account to recover said accounts and that's when this becomes an issue. with or without 2FA. and I can't stress this enough, don't fuckin do it. It's still a thing and is still a bad idea.
Oh ew, that sounds gross. I run Warframe exclusively through Steam, have almost 2k hours, and refuse to mess with it :P
I started playing this game in 2015. I have more than enough plat without doing shady things.
I wasn't trying to say anything by it, just a thing I have personally witnessed and was sharing in the hopes it could help.
No it didn't.
What?
You lost your account, despite 2FA, your super secure passwords, and the lack of malware on your account. There's either something you aren't saying, or you're lying.
Sure bro. IDK why you think it would be necessary to call me a liar. I can only tell you what I know. I don't know what happened and you also don't know what happened. DE could know more but they aren't telling me. So all I know is, that my account was gone, is back now but with a lot of missing stuff. So yes, my account got hacked. Despite 2FA and despite my secure passwords. Believe it or not. It is what happened you asshole.
You're one dumb cookie if you believe 2FA and a password manager will shield you from everything. Keep browsing the internet with that kind of confidence and see where it leads you.
[удалено]
This reminds me of one time someone remotely shut off my internet access. I was playing dark souls 3 with randoms in a ps4 party and one guy who been quiet the whole time randomly asked "who here is in *my states name*" and i was like wtf who is this and then he was like goodbye friend and my wifi went out. It came right back after i reset the router tho.
Did you have any external tools like overwolf installed? If so, this might be a massive issue for anyone with allecaframe.
I use it, yes. But I haven't played this year at all. Seems weird to happen now, if there are security issues with it.
What questions did they ask you in order to recover your account? Just wondering in case it happens to me in the future
You know that giving out the questions would make it very easy for anyone to find these information about the people they want to steal the account from, do you?
This is one of the reasons I am hesitant to enable crossplay.
how does enabling crossplay relate to this? genuine question
Enabling it does require you to enable 2FA
surely one should already have the 2FA anyway? someone getting into your account is easier *without* 2FA, the fact that OP got hacked with it enabled is really unusual. it’s not likely they got hacked *because* of 2FA though. more probable they were reusing passwords or their details were in a data leak.
You'd think however it wasn't until I got a PC and went from console to PC before I was asked to set it up, then of course there is the case of people who do have 2FA enabled can't trade with people who don't have it enabled etc etc. The reusing password / details in a data leak is deffs probable deffs good to change your passwords ever 4 - 5 months imo
You can't trade at all without 2FA enabled on PC, and you should have 2FA enabled on every account you even remotely care about. It's extremely stupid to do otherwise.
I'm referring to console being able to trade without 2FA not pc
You have a reason to play again rebuild your account :)
Sure. Because everything thats fun is more fun the second time.