Popular makers of custom gaming controllers, Scuf Gaming, were recently notified by many service users that their website had been compromised like so:
— Caleb. (@CalebMercs) June 2, 2015
It still lives on in Google Cache:
— Troy Hunt (@troyhunt) June 4, 2015
Dear Scuf Gaming Customer, As a valued customer, we take very seriously our duty to protect your privacy and security at all times. As such,we want to inform you of a potential data breach in a small number of our customer accounts that could potentially include some of your information. On the evening of June 2nd our IT security team discovered and reported that a very small number of our data records may have been compromised. We caught this immediately and rectified the issue. The only information that may have been compromised included customer names, addresses, email addresses, phone numbers and Scufgaming(dot)com passwords. PLEASE NOTE: We DO NOT store customer credit card or payment information on our servers – we interface to external payment systems including CyberSource, PayPal and Amazon which are fully protected. In addition, your scufgaming(dot)com password was stored in an encrypted format for added protection. HOWEVER, to be completely diligent and as a security precaution, we at Scuf Gaming felt strongly that our customers should be made aware of this potential information exposure. We recommend that you update your password on scufgaming(dot)com and if applicable, to be extra diligent, other sites that may use the same password.
There’s no word yet if they think the website hack and the data swipe are related – they could be entirely separate attacks,with multiple groups / individuals taking advantage of a way in to get up to mischief.
This is a fairly common pattern – a site running outdated software will be hacked, then another group will come along and replace the original defacement with one of their own.
At this point, your only way of knowing something might have happened is by having seen the email – I had a look at their Twitter feed and website, but there doesn’t appear to be any mention of the June 2nd “incident” or the website defacement.
One thing is for certain – if you have a Scuf account, you should definitely follow their advice and change your password, alongside making sure you’re not reusing the same login details elsewhere.
Many websites and services are compromised behind the scenes all the time, and you can bet that quite a few of them don’t bother sending anything out in terms of notification.
For as long as you don’t know a service has been popped, the people behind said popping have carte blanche to check for password reuse on your other accounts at their leisure. You can kill this threat to yourself off at the source by avoiding password reuse, and investing in a password management tool such as LastPass.
Go on – give yourself one less thing to worry about…