Blizzard / Battlenet security compromised

#0 - Aug. 4, 2010, 5:29 p.m.
Blizzard Post
Now before any of you [combative and unnecessary commentary removed] pipe in about me having something on my pc there isn't. I run 5 different viri, adware, and malware checkers every other day.

I also do have an authenticator.

The below email was sent to an email address ONLY Blizzard has. The computer that I game on isn't the same as the one I use for daily and business. The gaming computer isn't used for downloading any addons or net surfing. There are only two programs which have clearance to access the internet through my firewall, and no I don't use Microcrap's crappy one. It is a paid for professional one.

I do know more about computer security than probably 98% of Blizzard's employees in their Tech department. I own and run an IT company which provides that, along with other services.

I don't use or own a Visa card so I know for sure it is a fake email. That isn't a the major problem. It is that this was sent to an email account created just for WoW and the used for WoW. It is not auto checked via my email program. It is checked via web based.

How in the hell is this email account known outside Blizzard's Battle net service?
You guys either have a major security breech, Blizzard Entertainment is selling this information, or you have an employee who is accessing and is providing this information.

I've never played this game mentioned in the email. WoW is the only game installed on the gaming computer.

Now on to the email.



Hello, thank you for shopping at the Blizzard Store!

StarCraft II®: Wings of Liberty™: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

To use this key to activate the game, simply follow these instructions:


Create a Battle.net account (or if you already have one, log in) at http://support.worldofwarcraft.gameredemption.us/login.html
Verify your e-mail address. (If you have previously verified your address, skip this step.) From the main Account Management page, click the 'verify this e-mail address' link. Then, check your e-mail account for a verification e-mail. Click the link in this e-mail to verify your e-mail address.
Return to the Battle.net account management page, then click on 'Code Redemption'.
Enter the above CDKey in the code field.
Once you have successfully redeemed this code, you will be able to play the game.

NOTE: If you have previously chosen to gift your digital purchase, attaching this key to their Battle.net account will prevent you from being able to redeem this key with your Battle.net account.

===========================================
Purchase Receipt
===========================================
Customer Account: blizzard@compromised.com
Order Date: 2010-8-3
Order #: 0131175

(1) StarCraft II®: Wings of Liberty™ - $59.99

Credit Card Number : ****-****-****-3185
Credit Card Type : Visa
Item Subtotal: $59.99
Tax: $0.00
Shipping & Handling: $0.00
Shipping Tax: $0.00
Grand Total: $59.99
===========================================

If you have any questions or concerns about your order, please contact us at:

Phone: Toll-free at (1-800-592-5499)
Website: http://support.worldofwarcraft.net/account

Live phone support is available seven days a week, 8:00AM - 8:00PM Pacific Time.

Thanks for shopping with us!
Blizzard Customer Service

Message Identity ID: dyo.peox.pokmuat4r1kcwv



---------------------------------------------------------------------------------------------------------------------------

My account expires Aug 9. I won't be renewing after over 4 yrs. I had quit for over a year before and only came back after being talked into by a real life friend.
#17 - Aug. 5, 2010, 12:42 a.m.
Blizzard Post
Q u o t e:
How in the hell is this email account known outside Blizzard's Battle net service?


I was able to run a search for your e-mail address and found it listed on a website, Mudonface. Granted the site itself has nothing to do with gaming but that wasn't the point. The address is actually in public view and doesn't appear to be exclusive to your Battle.net account.

Looking for just the first part of the address comes up with a few more things, one of which is regarding online gaming.

Now it should be noted that phishing e-mails don't always come from a "list", the information is gathered from thousands of locations and some of those invites are simply blind.
Q u o t e:

You guys either have a major security breech, Blizzard Entertainment is selling this information, or you have an employee who is accessing and is providing this information.


I'm afraid in this case it is none of the above.

Q u o t e:

My account expires Aug 9. I won't be renewing after over 4 yrs. I had quit for over a year before and only came back after being talked into by a real life friend.


I'm sorry to hear that, Mudonface, I wish you well in your future endeavors.
#20 - Aug. 5, 2010, 12:50 a.m.
Blizzard Post
Q u o t e:
er, Vrak? Fs aren't Ws >.>


They could be though, and fhat a fonderwul forld that fould be!