GGG user data leak?

Should we all be afraid that our account will be hacked within the next days/weeks?

Any response from GGG would be nice here to clear up the situation.

Should we change the pasword now?

Whats about authentificator?

Only standalone client affected or also Steam client?

Any workaround ingame to prevent the situation?

That's pretty vague for those that don't know what the issue is. Perhaps provide some more information?

"

superdreddie#9796 wrote:

That's pretty vague for those that don't know what the issue is. Perhaps provide some more information?

The last days many accounts have been hacked and all items/currencies stolen.

"

CroDanZ#1818 wrote:

"

superdreddie#9796 wrote:

That's pretty vague for those that don't know what the issue is. Perhaps provide some more information?

The last days many accounts have been hacked and all items/currencies stolen.

Well, that sounds worrisome.
I took a quick look at the annoying website and there is only one topic that seems to reference a "hack". I would think there would be a lot more comments/discussion/topics if "many accounts" (as you claim) were actually compromised. Perhaps even a stickied topic or announcement.

If you're concerned you can always update your logins here on this website via Manage Accounts. And don't run third-party programs as these may contain key loggers or other malicious stuff, so properly remove those first before changing your passphrases.

"

superdreddie#9796 wrote:

"

CroDanZ#1818 wrote:

"

superdreddie#9796 wrote:

That's pretty vague for those that don't know what the issue is. Perhaps provide some more information?

The last days many accounts have been hacked and all items/currencies stolen.

Well, that sounds worrisome.
I took a quick look at the annoying website and there is only one topic that seems to reference a "hack". I would think there would be a lot more comments/discussion/topics if "many accounts" (as you claim) were actually compromised. Perhaps even a stickied topic or announcement.

If you're concerned you can always update your logins here on this website via Manage Accounts. And don't run third-party programs as these may contain key loggers or other malicious stuff, so properly remove those first before changing your passphrases.

You deserve r*ddit gold for that post, my friend. /s /r

"

CroDanZ#1818 wrote:

Should we all be afraid that our account will be hacked within the next days/weeks?

Any response from GGG would be nice here to clear up the situation.

Should we change the pasword now?

Whats about authentificator?

Only standalone client affected or also Steam client?

Any workaround ingame to prevent the situation?

If it's REALLY a 'hack' your password is no defense, if it's STEALING accounts due to password sharing then why wait?

AFAIK GGG doesn't use an 'authenticator' and it's not something AFAIK they've ever discussed as a possibility.

"

superdreddie#9796 wrote:

That's pretty vague for those that don't know what the issue is. Perhaps provide some more information?

One youtuber got their stuff stolen and are now claiming that GGG has a data leak with zero proof.

If it was a data breach it would be substantially bigger and we would know about it. The forums would be complete unusable because of the absolute spam of it.

Realisticly some players just got punished for bad security practice like reusing passwords or using actual words in their passwords(like "alligator3").

Well speaking about data leak probably is misleading but something strange happened.
I can also be a n00b player on PoE but spent years on IT/cloud/networking and
i speak only if there are data and here looks like we have it:

Go to Google and type "site:www.pathofexile.com account hacked" and if you wish
set the query only to get result from last week.

Well to my eyes it sound little bit strange that lot of people with different
client (Steam or PC), with or without 3rd party software running experienced
same issue without getting hit by unlock code that normally is sent when if play
from different location or, i can speak for my self, when you play from two different
pc on same lcoation (ny house)

Im not fingerpointing anything or anyone, just reporting raw data here

Only blame i can raise (but sitting on my chair from my home) is the way GGG act
when someone report an hacked account but again i run different (but similar) business
and i know it's hard (or better it's impossible) to make all happy.

I don't know about hacked accounts or leaks or anything, but it seems to be true that PoE2 does indeed not trigger the email activation if u're logging in from a different location.

At least in my case I had to do the verification process for PoE1 very regular because of dynamic IP, but not once did I have to do it in PoE2. Just type in the PW again, but no email verification. Kinda odd.

So if people are using weak passwords or get their pw leaked through 3rd party tools/phishing, they are most likely fucked.