Data Breach Notification

"

Genstein#2693 wrote:

This needs to be pinned to the front page.

"

mbitsu#0616 wrote:

"

BowWizard#1239 wrote:

GGG are legally obligated to disclose a data breach to authorities and their customers. In the US and Canada they must do so within 72 hours of knowing of the breach. The EU likely has similar requirements.
It gets worse because players were raising tickets weeks ago and yet there was no response from GGG, so they are way outside the 72 hour window.

It will be up to the authorities to determine what, if anything, they will require GGG to provide to customers in the form of things such as consumer protection services, fines against the company and other measures deemed appropriate, such as additional audits and reporting (their auditors should also be under the microscope) based on the scope of the breach.

By their own admission they did not have logging in place and certainly no alert notifications. They cannot tell exactly ow wide the breach is and if any other accounts have been compromised or there is an Trojan horse in place.

They've a long road ahead to regain trust and they better start communicating better to the player base.

Where does all this pressure come from?
Think about it.. the developers are working hard to make the game you play better. They have rework, tons of content to work on. And you're asking for some kind of compensation. Does the game work? Yes! Is there progress? Yes!
Moreover, the problem is old and, as you can see, not critical.
Do you want people to sit and dig through gigabytes of logs all day to help the victims? When the development itself is in full swing and deadlines are missed.
Nevertheless, people working on POE also need to rest. So, say words of support and gratitude instead.
Or do you want such minor problems to be responded to immediately? This never happens to anyone!
Personally, I don't know of any project where such problems could be rolled back.

"

The attacker also viewed account information for a significant number of accounts through our portal.

For those accounts they got access to the following private information:
Email Address if the account had one associated
Steam ID if the account had one associated
IP Addresses that the account had used
Shipping address if the account had previously had physical goods sent
Current Unlock Code for unlocking accounts locked due to logging in from a different region