Break-in at Blizzard's Battle.net
According to a statement by Mike Morhaime, president and co-founder of Blizzard Entertainment, the company's servers have suffered unauthorised access that exposed customer information to the attackers. The company learned of the intrusion on 4 August and decided to first investigate the problem and close the security holes before making the incident public. Battle.net is Blizzard's online game authentication and matchmaking platform, which is used by its Starcraft II, Diablo III and World of Warcraft games.
The leaked data contained email addresses and a number of other details from accounts based on North American servers – these include player profiles from Latin America, Australia, New Zealand and south-east Asia. Accounts based in China do not seem to have been affected by the problem. Blizzard confirmed that other data accessed by the attackers included the answers to security questions, "cryptographically scrambled versions of passwords" and certain, unspecified information belonging to various hardware and phone-based authenticator systems used by the company.
Blizzard says that the data taken from its servers is most likely not sufficient to gain access to Battle.net accounts, and notes that it has found no evidence to show that credit card information, billing addresses or the real names of account holders were compromised. Morhaime also said that the investigation into the incident is ongoing and that Blizzard is working with authorities to find those responsible for the attack.
According to Morhaime, the passwords that were copied off the company's servers are protected in such a way that makes it "extremely difficult" to extract the clear text password; Blizzard is apparently using the Secure Remote Password (SRP) protocol to protect those. In any case, Morhaime recommends that users change their password as a precaution. The statement does not mention the possibility that attackers could most likely circumvent the need for a password by using the stolen answers to the account's security question. Blizzard has, however, said that it intends to prompt users to change the answers to their security questions in the near future.
More information about the break-in, including the actions that Blizzard has already taken to resolve problems caused by it, is available in an FAQ on the Battle.net support site.