Town of Salem RP Game hacked, more than 7.6M Players affected

BlankMediaGames disclosed a data breach that affects millions of players of the popular role-playing game Town of Salem.

The BlankMediaGames suffered a data breach that impacted
more than 7.6 million players of the browser-based role-playing game
Town of Salem

Exposed data includes usernames, emails, passwords, IP addresses, game and forum activity. The bad news for players is that also their payment information has been compromised.

The data breach was reported to cybersecurity company DeHashed on December 28.

DeHashed received an email reporting the incident, the sender asked to be anonymous at this time and provided the company with evidence of server access and offered the complete database for disclosure.

“On 12/28/2018 we’ve received an email regarding the popular online RP game “Town Of Salem”s breach. The sender, who wishes to be anonymous at this time, provided DeHashed with evidence of server access and provided the complete database for disclosure.” reads a post published by
DeHashed.

“We’ve reached out to BlankMediaGames regarding a statement and to provide assistance with securing their servers.”

A Town of Salem representative that goes online with the name of
Achilles explained on the official forum of the game that payment data was not exposed. Achille pointed out that the game does not store any payment data and all passwords were hashed.

“We don’t store any credit card or payment info. At all. All passwords were hashed and not plain text. This means they do not know what your password is unless they run a program to attempt to guess it against the hashed password. Any reasonably strong password will take a very long time to be guessed. Your accounts should all be safe still if they used the same password, but you can change that as well if you are worried.”
Achilles wrote.

“The only important data compromised would be your Username/hashed password, IP and email. Everything else is just game related data.”

Dehashed blog revealed that passwords are hashed with MD5 algorithm that is known to be weak.

“Usernames, Emails, Passwords (phpass, MD5(WordPress), MD5(phpBB3)), IP Addresses, Game & Forum Activity, & Payment Information. With some of the users who paid for certain premium features having their billing information/data breached as well.” continues Dehashed .

“The total row count is: 8,388,894, with 7,633,234 unique email addresses.”

Dehashed already provided the data to the popular expert Troy Hunt that operates the HaveIBeenPwned service.

Once informed of the incident, BlankMediaGames found and addressed multiple backdoors on their server. They’ve made an official announcement here. 

“BlankMediaGames asked us to put this part in. Payment information includes Email, Full Names, Billing & Shipping addresses, IP Information, Payment Amount, and other details. No Credit Card Numbers.” concludesDehashed

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – Town of Salem, data breach)

[adrotate banner=”5″] [adrotate banner=”13″]