Jan 19, 2025 08:00:00

Hackers hack Path of Exile 2 admin accounts and hijack millions of characters

It has been revealed that an administrator account for the popular game

Path of Exile 2 , which has just entered early access, has been hacked, resulting in a large number of items being stolen from general users.

Hacker Broke into 'Path of Exile 2' Admin Account, Hijacked Wave of Characters
https://www.404media.co/hacker-broke-into-path-of-exile-2-admin-account-hijacked-wave-of-characters-2/

Jonathan Rogers, game director at Grinding Gear Games, the developer of Path of Exile 2, said that the incident started when someone hacked a Steam account. The account was linked to an administrator account on the Path of Exile 2 website, which allowed the hacker to reset other players' passwords and log into the game as those players.

Normally, when an administrator account in Path of Exile 2 makes a change, the log is recorded as an 'event' for later auditing. However, due to a bug, the password reset was recorded as a 'note' rather than an 'event,' which anyone could delete. Because of this, it was not known for a while that the hack had occurred.

The hack allowed hackers to steal rare and powerful items from players, and was

reported by the community as a result.

Path of Exile 2 is the sequel to the popular hack-and-slash game ' Path of Exile ,' and continues to enjoy high popularity, with the number of simultaneous connected players reaching approximately 580,000 immediately after release. The Path of Exile series places emphasis on 'trading' with other players, and is characterized by the ability to purchase items using a currency called 'orbs.' Some players engage in real money trading, which is prohibited by the terms of use. Some players who were hacked this time reported that their stolen accounts were traded for real money.

'66's notes were deleted, which means 66's accounts were compromised, but this breach occurred all before launch,' Rogers said. 'In light of this, we will be adding two-factor authentication to all admin accounts immediately. We would also like to implement two-factor authentication for player accounts, but are still evaluating this due to the complexity of implementing account recovery methods.'