{"id":72911,"date":"2019-11-17T03:07:53","date_gmt":"2019-11-17T10:07:53","guid":{"rendered":"https:\/\/www.taterboy.com\/blog\/2019\/11\/magic-the-gathering-game-maker-exposed-452000-players-account-data\/"},"modified":"2019-11-17T03:07:53","modified_gmt":"2019-11-17T10:07:53","slug":"magic-the-gathering-game-maker-exposed-452000-players-account-data","status":"publish","type":"post","link":"https:\/\/www.taterboy.com\/blog\/2019\/11\/magic-the-gathering-game-maker-exposed-452000-players-account-data\/","title":{"rendered":"\u2018Magic: The Gathering\u2019 game maker exposed 452,000 players\u2019 account data"},"content":{"rendered":"

The maker of Magic: The Gathering<\/em> has confirmed that a security lapse exposed the data on hundreds of thousands of game players.<\/p>\n

The game\u2019s developer, the Washington-based Wizards of the Coast, left a database backup file in a public Amazon Web Services storage bucket. The database file contained user account information for the game\u2019s online arena<\/a>. But there was no password on the storage bucket, allowing anyone to access the files inside.<\/p>\n

The bucket is not believed to have been exposed for long \u2014 since around early-September \u2014 but it was long enough for U.K. cybersecurity firm Fidus Information Security<\/a> to find the database.<\/p>\n

A review of the database file showed there were 452,634 players\u2019 information, including about 470 email addresses associated with Wizards\u2019 staff. The database included player names and usernames, email addresses, and the date and time of the account\u2019s creation. The database also had user passwords, which were hashed and salted, making it difficult but not impossible to unscramble.<\/p>\n

None of the data was encrypted. The accounts date back to at least 2012, according to our review of the data, but some of the more recent entries date back to mid-2018.<\/p>\n<\/p>\n

\"\"<\/p>\n

A formatted version of the database backup file, redacted, containing 452,000 user records. (Image: TechCrunch)<\/p>\n<\/div>\n

Fidus reached out to Wizards of the Coast but did not hear back. It was only after TechCrunch reached out that the game maker pulled the storage bucket offline.<\/p>\n

Bruce Dugan, a spokesperson for the game developer, told TechCrunch in a statement: \u201cWe learned that a database file from a decommissioned website had inadvertently been made accessible outside the company.\u201d<\/p>\n

\u201cWe removed the database file from our server and commenced an investigation to determine the scope of the incident,\u201d he said. \u201cWe believe that this was an isolated incident and we have no reason to believe that any malicious use has been made of the data,\u201d but the spokesperson did not provide any evidence for this claim.<\/p>\n

\u201cHowever, in an abundance of caution, we are notifying players whose information was contained in the database and requiring them to reset their passwords on our current system,\u201d he said.<\/p>\n

Harriet Lester, Fidus\u2019 director of research and development, said it was \u201csurprising in this day and age that misconfigurations and lack of basic security hygiene still exist on this scale, especially when referring to such large companies with a userbase of over 450,000 accounts.\u201d<\/p>\n

\u201cOur research team work continuously, looking for misconfigurations such as this to alert companies as soon as possible to avoid the data falling into the wrong hands. It\u2019s our small way of helping make the internet a safer place,\u201d she told TechCrunch.<\/p>\n

The game maker said it informed the U.K. data protection authorities about the exposure, in line with breach notification rules under Europe\u2019s GDPR regulations. The U.K.\u2019s Information Commissioner\u2019s Office did not immediately return an email to confirm the disclosure.<\/p>\n

Companies can be fined up to 4% of their annual turnover for GDPR violations.<\/p>\n

\n
\n

Stop saying, \u2018We take your privacy and security seriously\u2019<\/a><\/p>\n<\/blockquote>\n<\/div>\n

\"\"<\/p>\n

Powered by WPeMatico<\/a><\/small><\/p>\n","protected":false},"excerpt":{"rendered":"

The maker of Magic: The Gathering has confirmed that a security lapse exposed the data on hundreds of thousands of game players. The game\u2019s developer, the Washington-based Wizards of the Coast, left a database backup file in a public Amazon Web Services storage bucket. The database file contained user account information for the game\u2019s online… Read the full article…<\/a><\/p>\n","protected":false},"author":4,"featured_media":72912,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[174,377],"tags":[],"class_list":["post-72911","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-games-media","category-gaming"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t