Hello everyone. I bring some unfortunate news today. Yesterday, Christmas Day, at roughly 12:30 PM Eastern time, we experienced a security breach. At roughly 1:20 PM, that breach allowed a malicious upload to overtake our game on Steam's library. Our steam and discord accounts were hijacked, and though the Steam accounts were able to be recovered late in the evening, we were limited in our ability to warn or communicate immediately following the breach.
Seriously, 27 hours from when it first happened to report it to users? Especially when most of that intervening time was spent recovering things? That’s stellar. We’re lucky to hear about corporate breaches in 6 months.
It’s also incredibly clear and gives a lot of information on when you do and don’t need to be worried. I’d probably take the extra steps to verify I wasn’t exposed even if I was in one of the “you’re OK” categories, but I appreciate the detail on principle.
It’s weird that “we got hacked” is going to get me to try out a mod, but here we are lol.
The same is true for other stuff too. For example, I’m more likely to use a password manager if they handled a breach responsibly than an unproven service. I’m looking for essentially three things from a breach:
when did they detect it, and what was their immediate response?
how transparent were they in communicating the breach, and did they need to make amendments later? (more tolerance if they’re quick with reporting the breach)
what changes did they make to ensure it doesn’t happen again? Were those changes merely to patch this vulnerability, or did they notice other vulnerabilities?
Breaches happen, so I’m mostly interested in how their existing security ops mitigated the fallout (e.g. did they properly salt passwords, have transaction limits on the DB, etc), and how thorough the investigation was. A good org will be much stronger after a breach than most competitors, so if everything checks out, they’re probably a safer bet going forward.
Given the scope of this project (a non-commercial free mod), I would honestly not judge them harshly for a much poorer response. It’s not their job; if they took a couple days to notice during the holiday season, then weren’t able to say much more than “we think you’re fucked if you have this mod installed”, a lot of harm might be done, and they’d definitely see a lot of criticism, but I’d understand. For a small team that don’t do security, especially one who aren’t even selling their product, getting hacked has the potential to be extremely overwhelming, and you very possibly don’t have the expertise or resources to investigate properly.
Instead, they put a bunch of real companies to shame. (Some of those companies have breaches that are a lot more complex in scope, but still.)
Yup, I 100% agree. I absolutely take the size of the org, the risk to me (e.g. medical info is more impacted than game playtime), and how much I paid into account when evaluating a response.
This was a way better response than I could ever hope for from such a project.
This is how you communicate a security breach.
Seriously, 27 hours from when it first happened to report it to users? Especially when most of that intervening time was spent recovering things? That’s stellar. We’re lucky to hear about corporate breaches in 6 months.
It’s also incredibly clear and gives a lot of information on when you do and don’t need to be worried. I’d probably take the extra steps to verify I wasn’t exposed even if I was in one of the “you’re OK” categories, but I appreciate the detail on principle.
It’s weird that “we got hacked” is going to get me to try out a mod, but here we are lol.
The same is true for other stuff too. For example, I’m more likely to use a password manager if they handled a breach responsibly than an unproven service. I’m looking for essentially three things from a breach:
Breaches happen, so I’m mostly interested in how their existing security ops mitigated the fallout (e.g. did they properly salt passwords, have transaction limits on the DB, etc), and how thorough the investigation was. A good org will be much stronger after a breach than most competitors, so if everything checks out, they’re probably a safer bet going forward.
Given the scope of this project (a non-commercial free mod), I would honestly not judge them harshly for a much poorer response. It’s not their job; if they took a couple days to notice during the holiday season, then weren’t able to say much more than “we think you’re fucked if you have this mod installed”, a lot of harm might be done, and they’d definitely see a lot of criticism, but I’d understand. For a small team that don’t do security, especially one who aren’t even selling their product, getting hacked has the potential to be extremely overwhelming, and you very possibly don’t have the expertise or resources to investigate properly.
Instead, they put a bunch of real companies to shame. (Some of those companies have breaches that are a lot more complex in scope, but still.)
Yup, I 100% agree. I absolutely take the size of the org, the risk to me (e.g. medical info is more impacted than game playtime), and how much I paid into account when evaluating a response.
This was a way better response than I could ever hope for from such a project.
Yeah that was incredibly incredibly clear