Hackers breached and downloaded sensitive account data from the Supercell forum, the harvested data is sold on underground marketplaces.
Supercell Forum Hacked and The Data Auctioned Underground
Computer criminals have breached yet another gaming community. This time its the Supercell Forum that got hacked. The company is the developer of many popular games including, Boom B Clash Royle, Clash of Clans each and Hay Day. According to the various media reports about 1.1 million user accounts are affected by the security issue.
Supercell commented that they have launched an investigation into the incident. According to them the actual breach happened in September 2016. The vulnerabilities are attributed only to the Forum software. The hackers have used a vulnerability in the outdated vBulletin software which is used to power the Forum.
Unfortunately the harvested credentials can be sold on the black market. This is one of the most widely used strategies to gain income. In the last few years we have seen an increasing trend of hacking large communities and selling the harvested databases of data on the underground sites. There are several ways in which the compromised account credentials can be used:
-
Social Engineering Attacks – The hackers use the accounts to launch phishing attacks by spoofing the victims with the stolen data.
-
Account Intrusion – The hackers analyze the accounts and attempt to use the credentials to login to other popular services such as social networks and email accounts.
-
Extortion – The hackers can intimidate the victims of leaking their data to the public or posting private messages publicly.
Supercell published an official statement giving details on the breach on their forums:
Dear Supercell Forum user,
As we’ve said before, to provide our forum service we use software from vbulletin.com. We’re currently looking into report that a vulnerability allowed third party hackers to gain illegal access to some forum user information, including a number of emails and encrypted passwords. Our preliminary investigation suggests that the breach happened in September 2016 and it has since been fixed.
We take any such breaches very seriously and we follow very strict policies when it comes to security. Please note that this breach only affects our Forum service. Game accounts have not been affected.
To make sure your account is not being accessed without your knowledge, please change the password you are using on this forum as soon as possible. You can reset your password here: https://forum.supercell.com/login.php?do=lostpw
We also strongly advise you to change the password in any other systems you are using with the same login. As a general guideline, matching credentials should not be used on multiple sites.
We apologise for the inconvenience this has caused.
Best Regards,
Supercell Community Forums
