Japanese gaming company Koei Tecmo has revealed that it has been the victim of a data breach that has taken its European and American sites offline , after the stolen data was posted on a hacker forum.
Koei Tecmo is known for popular PC and console games, such as Nioh 2, Hyrule Warriors, Atelier Ryza, Dead or Alive , etc.
On December 20, a hacker claimed to have compromised the koeitecmoeurope.com website (on December 18) via spear-phishing emails sent to an employee of the gaming company. The hacker managed to steal a forum database with 65,000 users and, according to his words, has placed a web shell on the site for constant access.
"There are FTP credentials in the shell and I would be happy to share them with you if you purchased the shell, as well as many Twitter for their Twitter accounts," the hacker said.
In a post on a hacker forum, the criminal attempted to sell the stolen Koei Tecmo database for 0.05 bitcoin or about $1,300, and the web shell access for 0.25 bitcoin or about $6,500.
However, a few days later, on December 23, the attacker leaked the database for free on the same hacking forum.
According to some samples seen by BleepingComputer, the stolen database includes forum email addresses, IP addresses, hashed passwords and salts, usernames, dates of birth, and countries.
Koei Tecmo forced to take its sites offline
Upon learning of the exposed data, Koei Tecmo took down its American (https://www.koeitecmoamerica.com/) and European sites (koeitecmoeurope.com) and left the following message:
“Due to the possibility of an external attack on this site, it is temporarily down while we investigate the issue.“.
Koei Tecmo also released a data breach advisory, stating that a forum on its UK subsidiary's site was hacked and stolen data was leaked online.
“The site’s “Forum” page and registered user information (approximately 65,000 entries) are the data that may have been compromised,” Koei Tecmo revealed.
However, the gaming company said the breach only affected the forum and not other parts of the site. It also said that financial information users' was not affected, as that data is not stored in this database.
The company said the chances of a ransomware attack are low, as it has not been asked for money.
Koei Tecmo isn't the only gaming company to have suffered a cyberattack this year.
Crytek and Ubisoft were victims of the Egregor ransomware , and Capcom was attacked by the Ragnar Locker ransomware , which led to a large data theft (1 TB).
Source: Bleeping Computer
