Another hacked account

[jotmon]

At this point i:m starting to believe this must be and iinside job and they know what's happening but have no Power/tools to stop It and that's the reason why they don't talk about It. It's not a coincidence that all the targeted accounts had quite some points and other stuff available. Someone that have/had access to their database must be at work. It's too fast, too precise and too widespreed to be a random hacker.

doubtful.

I've heard of instances of players logging in to their own accounts and ending up in someone else's character list with access to the others person's DDO store account.

Seems to me there's an obscure issue of securing player logins accounts to their character data and banking info that no one from SSG wants to talk about.

 

[Solarpower]

even as simple as just setting up Authy / Google Authenticator / whatever other 3rd party Autheticator app the user wishes to use.

Why do you think it's "simple" ?
The existence of ready-made authenticators is one thing. The main thing is how to connect them to the game ! But it may not be that simple.

SSG can't even make a simple server selection without having to restart the game. And here you are, talking about connecting a third-party app to the game...

 

[Grumgrim]

I was probably on codemasters priginally but had to create a new usename when the accounts were transfered to US servers.

well it looks like i got the expected response from SSG about my account being accessed and drained: "Unfortunately, we’re not able to recover any coins or items that were lost. Please remember that keeping your account secure is the player’s responsibility"
so now have a compromised username and a system that allows brute forcing of passwords and no help from SSG, currently thinking I will continue to play for now but no more points, vip, or patron supports or big packs. Happy to spend money not happy to have SSG let others steal it

With the amount that I have heard happening its either easy or a member of SSG staff is doing it. Interesting thing is you have no idea if they have access to your account and have already checked to see if you have enough points or stuff available or a way to add more points. if you diddnt they could just log off and try next time double point and ottos are available

 

[Grumgrim]

So got a response from Lead GM Woebot with a generic your fault this is how to do a secure password without addressing any of my concerns, I tried to respond but got "Your message wasn't delivered because the recipient's email provider rejected it"

So Ill start by post my response here, I previously asked for thier procedure for complaints and resolutions but that was missed/ignored

"
So you are 100% sure someone logged into my account using my username and password?
They didn't happen into by mistake as I have seen numerous reports off? And have even ended up doing myself at one point. ( Although I would never steal unlike others it seems)
Your system is not secure. I can do no more than I have to secure my account you will not allow me to even change my username.
There is nothing I can do with the tools you provide to stop someone re Accessing my account either by brute force or luck (considering how many people this is happening too I suspect people have found a way of increasing the chance of it happening)

Years of support buying every patron coffer, ultimate pack and VIP not to mention additional points means nothing when your system fails me?
I do not intend to let this go at the very least there should be something done to stop this happening.
Allow us to have separate password for the store, bind boxes to account. Something.

If nothing can be done I will look into what the next steps are.
Do you have any further escalation to this or is the end of your problem solving/complaint procedure?

Regards"

 

[Jummby]

So got a response from Lead GM Woebot with a generic your fault this is how to do a secure password without addressing any of my concerns, I tried to respond but got "Your message wasn't delivered because the recipient's email provider rejected it"

So Ill start by post my response here, I previously asked for thier procedure for complaints and resolutions but that was missed/ignored

"
So you are 100% sure someone logged into my account using my username and password?
They didn't happen into by mistake as I have seen numerous reports off? And have even ended up doing myself at one point. ( Although I would never steal unlike others it seems)
Your system is not secure. I can do no more than I have to secure my account you will not allow me to even change my username.
There is nothing I can do with the tools you provide to stop someone re Accessing my account either by brute force or luck (considering how many people this is happening too I suspect people have found a way of increasing the chance of it happening)

Years of support buying every patron coffer, ultimate pack and VIP not to mention additional points means nothing when your system fails me?
I do not intend to let this go at the very least there should be something done to stop this happening.
Allow us to have separate password for the store, bind boxes to account. Something.

If nothing can be done I will look into what the next steps are.
Do you have any further escalation to this or is the end of your problem solving/complaint procedure?

Regards"

They are in full deny until you die legal mode, if what you say is true.

 

[Grumgrim]

Further update - response from them

"Thank you for following up and for taking the time to outline your concerns in detail. I understand how upsetting this situation is, especially given the time and money you’ve invested into your account over the years. To clarify, after review, there is no indication that Standing Stone Games’ systems were breached or compromised in this case. All investigated incidents of account compromise have been the result of account credentials being exposed outside of our systems. This typically occurs through phishing attempts, reused passwords on third-party websites, malware or keyloggers on a local machine, or logging into non-official sites that request account details. While we understand the frustration around not being able to change a username, access to an account still requires the correct password. Without that password, a login cannot occur. For that reason, protecting and isolating your password remains the most effective way to secure your account. To help prevent this from happening again, we strongly recommend the following: • Use a completely unique password that is never used anywhere else (not forums, Discord, other games, or email accounts). • Create a password specifically for your SSG account and do not store it in browsers or password managers tied to shared devices. • Avoid logging into any website other than official SSG properties (the game client, MyAccount page, and forums). • Run regular malware and antivirus scans on your system to rule out keyloggers. • Change your password periodically, even if you believe it has not been exposed. Unfortunately, once points or items have been spent or removed as a result of an account compromise, we’re unable to restore or reimburse them. This decision is based on policy and is consistent across all similar cases. We understand that this is not the outcome you were hoping for, but please know your feedback regarding account security options has been documented and shared with the appropriate teams for consideration. If you have additional questions or need assistance with securing your account going forward, we’re happy to help. Thank you for your time and understanding"

so generic copy and paste ignoring my actual questions

my response

"This does not answer the question. I asked if they logged into the account or they ended up in my account which is an issue I have seen myself and is widely reported. It happens when logging in or logging out a character and you end up in someone else's account. This is a fault with your system not a breach of my username/password. If they logged in you should have logs and should be able to tell me if it was a result of knowing the password or brute forcing it with multiple incorrect attempts. Depending on the issue tells me if I can continue to spend money with you or if your security is too poor to continue. Please read and respond. I have repeatedly asked for your complaints and resolution procedure and that question has also been ignored. Please can you answer that"

This is my last attempt at nice, next step legal/regulatory bodies.
I was upset, now I am angry, repeatadly ignoring the questions is terrible, currently preparing posts for every social media outlet I can think of. If nothing else everyone who plays the game needs to know these vulnerabilities and that ssg cannot be trusted to have points loaded, items on your character or have certain payment options saved as they are not secure or safe

 

[Dreadsnought]

Add me to the list of hacked accounts and they spent over 1400 dollars and drained my account of ddo points. SSG just does not seem to care that this is reported over an over. There is something wrong with thier login server that is not removing a previous accounts information and the next person logging in has access to someones account and apparently some hackers have figured out how this occurs and are exploiting it.

 

[Zavina]

Ask them to supply a copy of all IP records logged in on your account accessing their database. Even if the unknown user is using a VPN, and you aren't, then you'll have a constant supply of X numbers and a singular instance of Y appearing.

As it's your personal account, there is no data to be breached, or any loss of confidentiality.

 

[Dreadsnought]

They are in full deny until you die legal mode, if what you say is true.

So to add to your info to provide to those social media. Daybreak games (the vendor name under which the paypal is being billed ) has completely invalid dispute resolution information. The phone number does not work , the email is no longer valid and the standingstonegame postmaster sends back an invalid email address message. i have reported this to paypal. I personally think this vendor should be removed from paypals approved vendors unless this is fixed. Oh btw I also purchased a ultimate sharn bundle, never receive my one time items, sent a ticket december 3rd and have had absolutely so response and yesterday I was hacked for 1400.00 dollars of ddo point purchases immediately converted to astral shards. Submitted ticket immediately. i have little hope SSG will ever respond, though 1400 dollars is considered to be a felony level of fraud. The idea that any company can get away with this level of unresponsiveness and not be shut down is ridiculous.

 

[Blaster]

I wonder if the OP provided them of the name of the "sketchy" third party site their guild member insinuated on Reddit they used to buy boxes from, which could have been a potential source for their account information.

https://www.reddit.com/r/ddo/comments/1q1dyxs/_/nx5591t

(The DDO EULA was also seemingly recently updated, so if there wasn't already wording in it releasing DDO/SSG/Daybreak Games/EG7 from liability, there most likely was some added.)

 

[Titus Ovid]

A friend of mine got robbed, as well.
This was the answer from CS:
[...] Unfortunately, we’re not able to recover, refund, or reimburse for any coins or items that were lost. Please remember that keeping your account secure is the player’s responsibility. I truly wish I had better news, but we’re unable to help with this situation. Thank you for your understanding and I do apologise for the inconvenience [...]

Why can't SSG assist in this case? Are there no logs, no ips, no whatsoever? If the purchase happened from a different IP or when consumer behaviour suddenly changes, it is a sign that something is different or even wrong. That is a good indication to start an investigation.
Another reason would be that this kind of incidents seem to happen more often even regularly right now. How many player need to be effected by this before SSG is reacting?

Cheers,
Titus

 

[Baconator]

Arc Raiders and another Embark Studios game have been under attack for a few weeks.
On 2 different gaming websites there were refernces pointing towards Discord. In the past year Discord has had lots of problems with hacks.
My friend that recently got hacked here for a boatload of Otto's boxes IMO got hacked via our old channel that I had to delete. (and will NOT create another one)

 

[Dendrix Deathblade]

I got the same useless response.

 

[Grumgrim]

Ask them to supply a copy of all IP records logged in on your account accessing their database. Even if the unknown user is using a VPN, and you aren't, then you'll have a constant supply of X numbers and a singular instance of Y appearing.

As it's your personal account, there is no data to be breached, or any loss of confidentiality.

they refused
they have no interest in fixing this, they are just hoping we will go away.

 

[J1NG]

I wonder, for the players that had their accounts accessed (for whatever reason) and lost IRL money from it (purchases) can you give us approximately what time that happened if you have that information?

In theory, we can roughly work out which "awake" region is more likely the culprit. But we need info to work with, so if anyone who was impacted knows the time frame their unauthorised purchases happened (attempted Paypal checkouts, actual Paypal checkouts, email receipts from SSG when purchasing, etc), then it's possible to formulate something to test and attempt to replicate what is (suspected of) being done.

J1NG

:: edit ::
For anyone that is wondering what good would this info do really? Well, it allows us to theorise with existing info on the matter, on whether the (theoretical) parties involved is attempted brute force methods (and what way) and thus it is limited to specific times of the day that it can happen (but we need actual info from affected parties to pony up any info they have so we can crossmatch and check which scenario is likely) - then can work on replicating it and if successful (much like how I knew of the Multi-Curse methods but not that it impacted core aspects of DDO until someone mentioned getting it whilst in the bank), there's a chance I can force SSG to do something. But without info to look for commonality, it becomes difficult to do anything.

 

[Blaster]

Do I have something I need to admit to? Yeah, if your hack came as a result of your actions, then you reap what you sow. There you go. My great admission is this: Your actions have consequences.

I, like others, am trying to find cause and effect here. If you didn't use a third party site to buy boxes, then there may be another reason your account got hacked. If you did buy third party boxes and that's not the cause of your hack, then there must be another reason. We're just trying to figure it out.

Personally, I don't care what you did or didn't do and what it resulted in, but if we can find any commonality amongst the accounts that have been compromised, then perhaps people can figure out a way to avoid such issues in the future.

(Just like how players saw the need for crowdsourced debugging information when SSG falls short. People see problems, try to find solutions, so that in the future hopefully someone else can benefit from those solutions.)

I've stated what I've seen and the connections I've made. We have European accounts, some possibly old enough to link back to the beginning of DDO and whose credentials have passed through multiple ownership/development hands at this point. Players getting tight-lipped when asked for more details about potential causes for their hack leading to the possibility that they engaged in activity that could have compromised their accounts. That's just what I see from my perspective, but there's probably more.

At the end of the day you agreed to DDO's EULA. Good luck fighting that. Spend your time, money, and life fighting a battle you're not going to win. And if you do win, great, we'll throw you a party, and I'll saddle up and have a big ol' slice of sh*t pie and admit I was wrong.

In the meantime you're probably going to keep playing the game. So many players have threatened to leave, and few follow through with it. If you have true conviction to turn your back justifiably so on a company that doesn't care about you -- and spoiler alert, companies don't care about you -- well then good for you. You deserve to do something with your life that respects your time and your money.

 

[Mindos]

reap what you sew

 

[Skiantoss]

In my case i've never been or bought anything from shady sites, never shared my credential to anyone, here is a picture of what and when happened

https://imgur.com/a/bgnmxH7

 

[JammyHammy]

I wonder, for the players that had their accounts accessed (for whatever reason) and lost IRL money from it (purchases) can you give us approximately what time that happened if you have that information?

In theory, we can roughly work out which "awake" region is more likely the culprit. But we need info to work with, so if anyone who was impacted knows the time frame their unauthorised purchases happened (attempted Paypal checkouts, actual Paypal checkouts, email receipts from SSG when purchasing, etc), then it's possible to formulate something to test and attempt to replicate what is (suspected of) being done.

J1NG

:: edit ::
For anyone that is wondering what good would this info do really? Well, it allows us to theorise with existing info on the matter, on whether the (theoretical) parties involved is attempted brute force methods (and what way) and thus it is limited to specific times of the day that it can happen (but we need actual info from affected parties to pony up any info they have so we can crossmatch and check which scenario is likely) - then can work on replicating it and if successful (much like how I knew of the Multi-Curse methods but not that it impacted core aspects of DDO until someone mentioned getting it whilst in the bank), there's a chance I can force SSG to do something. But without info to look for commonality, it becomes difficult to do anything.

I didn't have my account compromised, but know someone who had their account compromised, so I can hopefully shed a little light on information (at least in this specific instance). This happened on Moonsea sometime between 1 and 2 pm est on December 20th, at least this is when the person who accessed the account logged out, so it could have been between noon and 2 pm est, but in that ballpark. The person affected was logged in at the time it happened. Most of the payments were ddo points and were in increments of 249.99 usd. The person who accessed the account must have had access to the password, whether through brute forcing or some other means, because they had logged in to the standingstonesgames website and had changed the email associated with the account as well as the password. Because they had logged in on the website with their password, I doubt it was simply about improper logins switching accounts with another and being able to access their characters and store from there. I will say that they have been playing the game since 2010 and have at least had the same password for a majority of that time, with the password being fairly simple so it is not impossible that the password could have been found through brute force attempts. They have never interacted on any of the third-party sale sites, so they wouldn't have had their password leaked through that. If there's any information more specific you'd need, I can get in contact with them to ask, but that is the gist of what occurred.

 

[Grumgrim]

I didn't have my account compromised, but know someone who had their account compromised, so I can hopefully shed a little light on information (at least in this specific instance). This happened on Moonsea sometime between 1 and 2 pm est on December 20th, at least this is when the person who accessed the account logged out, so it could have been between noon and 2 pm est, but in that ballpark. The person affected was logged in at the time it happened. Most of the payments were ddo points and were in increments of 249.99 usd. The person who accessed the account must have had access to the password, whether through brute forcing or some other means, because they had logged in to the standingstonesgames website and had changed the email associated with the account as well as the password. Because they had logged in on the website with their password, I doubt it was simply about improper logins switching accounts with another and being able to access their characters and store from there. I will say that they have been playing the game since 2010 and have at least had the same password for a majority of that time, with the password being fairly simple so it is not impossible that the password could have been found through brute force attempts. They have never interacted on any of the third-party sale sites, so they wouldn't have had their password leaked through that. If there's any information more specific you'd need, I can get in contact with them to ask, but that is the gist of what occurred.

they did not change my email or anything like that which makes me believe it could have been the end up in someones account situation, luckily they couldnt add more points but I had a lot at the time. and shards.
My last logged action (25ddo points due to levelling) was Dec 24th 23:00:07
My next logged action wasDec 25th 16:41:25 (again 25ddo points due to levelling)
Date was December 25th 2025, 07:59:59 as that is when the first unauthorised points were spent. Last points were spent 08:00:37. (15k of points spent in 5 different purchases) not sure when the existing 4k shards were spent but between the two points.
I was probably on after the last 25 earned and before the next 25 were earned but I cant see log on info just points spent.