Digital Extreme has revealed that over 775,000 Warframe players has had their emails leaked to hackers but passwords and financial details were not included in the data breach.
The game is one of the famous multiplayer shooters in Steam as it takes players into space and other planets to carry out missions where they can shoot and slash to kill enemies. Warframe developer Digital Extreme said that the game's players were victims of the data breach in November 2014 and that they are only discovering about it now.
Despite the admittance, the developer said that the data breach did not come from their side. Digital Extreme said that the hack was conducted through a phishing attack done via a Drupal SQL exploit that was already fixed by Drupal just 14 days after the breach itself was created, MCV has learned.
The Warframe servers and forum sites from Digital Extreme was said to be secure at the time which led to the conclusion that it was an attack on the outside. Users could have been duped into entering their emails into a fake website posing as a legit one for Warframe players.
Warframe players need not worry much as only their emails were taken by the hackers, Gamasutra reported. There were no passwords or addresses included in the breach.
Unfortunately, Digital Extreme did not mention who or what the hackers wanted. They also did not confirm whether the culprits have been caught or if they are still out there trying to dupe Warframe players into logging in their fake sites and such.
"The stolen data DID NOT include any account passwords, variations of passwords, hashed passwords, game account data or personal player information such as full names, addresses or other billing and payment information," Digital Extreme said in a forum post.
To help protect Warframe players more in the following months and years to come, Digital Extreme said that they have reinforced their security measures when logging in the game and their websites. The Warframe developer has added two-factor authentication (2FA) to reinforce the security and also decided to use a new custom website system for account information instead of the Drupal system that was hacked.