Basically unconfirmable situation in almost all instances.
1.There is a known issue where it is possible a player that is logging in can end up with someone elses account on logon instead of the one they logged in as. (I personally ran into this twice now over the 16-17 years of DDO)
1.a. Most players immediately log off, but it is theorised that some have decided to take advantage of the situation instead. Due to the way things are, there is no actual proof that this was done by anyone who encountered this situation however, since it would require the one at fault to incriminate themselves by recording them performing the unauthorised purchases, etc and then post about it.
1.b. There is no immediately recognised way to replicate this scenario (getting into a different account). Whilst there are suspisions over here, there's no testing approach that is suitable for me to post about here. No testing is also going to be attempted because it could cause the tester (whilst testing for the flaw) an actual ban. (Sorry, I like the community, but I don't like you THAT much that I'm happy to get one of the more serious responses done when I get tagged by any systems in the process).
2. Many of the posts about account hacks (on the main forum) have been majority from "new" forum posters. (I personally have not looked at discord posts, but have read from others that there's a few of those lately)
2.a. Many of the threads about this are individual experiences (which no one is disputing is happening or not with insufficient evidence either way), however, they also happen to be lacking in detail about their accounts, making it difficult to gather information and evidence to form a theory about what is happening, how it is happening and how to test for it.
2.b. This is made especially difficult when said players feel they are being questioned, or are so focused on their situation only and "shut off" from engaging further with questions. (Again) Preventing any way to form theories as to what is happening and to test them out.
2.c. Key information that realistically needs to be gathered are:
2.c.i. How old the account is (Stolen data, see 3 below)
2.c.ii. Were the Account and Forum details the same? (Some used the same details, resulting in needing only Forum data being stolen to be able to access their in game account)
2.c.iii. Has their data been shared with others before? (There's always stories of someone who didn't look after any data they have got and caused no end of problems to themselves or others)
2.c.iv. Where are they geographically? (This is related to the data breach that happened to Codemasters)
3. It is KNOWN that DDO and Codemasters (Euro server runners of DDO) both have had player data stolen in 2013 and 2011 respectively.
3.a. This data breach could be one of the reasons why players accounts have been accessed so easily (and readily)
3.a.i. Such as by having Account Names being the same as their Forum Names (AND Passwords too)
3.b. It is also possible that Codemasters didn't have as tight security and had even more linked information that was stolen.
3.b.i. Because we know from what SSG staff have said that integration of data from Codemasters was a problem and was part of the problem of server transfer issues as well recently, suggesting some data might not all be in alignment with "how they should be".
4. For now, everything is being classed as an "Account Hack".
4.a. This is because there is no confimation of any suspected method as the ultimate cause of the "Unauthorised Action".
4.b. This includes being careless with data yourself, sharing the data with others and them being careless about the data or their protection of the data, actual hack, brute force multiple password attempts, to lying about it being a hack (for whatever reason), being in cahoots with the actual offender in trying to pull a fast one, etc.
4.b.i. Due to lack of evidence of any one particular action being the thing that happened.
And if the devs are willing to comment - is it advisable to change our passwords?
Not a Dev here.
But, "MY" recommendation is not to wait.
Why?
A. Changing your password now can only reduce the chance of your account being "Hacked" by someone who is going through the data breach on DDO or Codemasters.
A.1. This prevents any long time accounts from being immediately checked up on by stolen data.
B. Change any payment methods that are automatic as well such as Paypal under certain circumstances. This prevents automatic purchases that could have been performed without you knowing.
B.1. I for example require a login to Paypal, as well as the 2FA there to get to the payment stage.
B.1.i. This prevents any unintended logins to my account from being able to make purchases without me knowing.
C. Always perform such security actions (changing of passwords) on known "clean" computers to prevent accidental/unintended exposure to third parties.
There are likely more recommendations by other forum members, but this is what I have to offer thus far. (Not a lot of time on hand due to IRL duties)
J1NG
