#0 - July 12, 2010, 9:03 a.m.
First, none of the usual weak points seem to apply. The account was not hacked via my email as the passwords are different and the Battle Net one was unchanged. Both of the computers used to play WOW are mine and are running up to date anti-viral and anti-malware. Deep scans did not find any problems, a check of the process lists found nothing new or unexpected. No .exe mods have ever been installed etc. I have never bought/sold gold, used power leveling services, etc. The account is not shared, the password has never been written down, is not a name, date, etc. It was 3 letters, 3 numbers, and then 2 letters. They were random, not in any sort of pattern. In short, except for possibly adding an authenticator, there isn't anything I could reasonably have done to further secure the account.
Several things stood out.
1) Why didn't I have an email warning sent that an authenticator was added? This would have told me right then of the problem.
2) Eight different characters that had been created within a week or so of launch and were level 70 or higher were deleted. Again, this did not generate a warning message.
3) An additional 15 or so characters, including a level 80 DK were also deleted. No message to warn me was sent.
4) The two toons that were not deleted were stripped of all equipment. This should also generate a warning email.
5) Thousands of gold were moved off the affected characters. Such large scale movement should have raised a flag.
6) About 26 characters, all left at level 1 were created on to a server.
--------------------------------
This raises a number of suggestions.
1) Send a warning when an authenticator is added.
2) Send a warning email when a character is added or deleted.
3) Allow the player to set a threshold of gold per hour that can be traded via the AH, trades, etc before an email is sent to inform the player of the action.
Any of those would have made the hacking obvious. The lack of an authenticator warning is especially bad given how it is abused by hackers to lock people out of their accounts. There is really no excuse for it.
