Razer is investigating the data breach allegations and restoring user sessions.
Gaming equipment company Razer responded to recent rumors of a massive data breach with a brief statement on Twitter, informing users that an investigation into the matter has been launched.
Razer is a popular American-Singaporean technology company that focuses on gaming hardware, selling high-quality peripherals, powerful laptops, and apparel.
The company also sells services that provide registered account holders with access to an extensive collection of games, special in-game item offers, exclusive rewards, and more through the Razer Gold payment system.
Information about a possible data breach at the company emerged on Saturday, when someone posted on a hacking forum that they had stolen the source code, database, encryption keys and backend access logins for Razer.com, the company's main website.
The user offered to sell this data for Monero (XMR) cryptocurrency and urged interested parties to contact him directly to close the deal.
The publisher of the post has not set any restrictions or exclusivity, meaning that anyone willing to pay the requested amount will get the entire data set.
Screenshots posted as evidence of the breach show file lists, email addresses, source code allegedly for anti-cheat and reward systems, API details, Razer Gold balances, and more.
Cybersecurity analysts at FalconFeeds.io spotted the announcement on the hacking forum and shared it with the public. In response to the tweet, Razer said it was looking into the possible incident and had launched an investigation.
BleepingComputer was able to confirm that the leaked accounts are valid and belong to legitimate users of the site.
Additionally, BleepingComputer discovered that Razer has reset all user accounts, canceling their current sessions and prompting them to reset their passwords.
Researcher Bob Diachenko discovered an unprotected Razer database in 2020, which contained the full names, email addresses, phone numbers, customer IDs, order details, and billing and shipping addresses of 100,000 customers.
It is unclear whether anyone other than the researcher accessed or copied Razer's data between August 18, 2020, and September 9, 2020, when the database was exposed.
From the data samples leaked this time, it appears that the information is more recent and dates back to at least December 2022, so the two incidents are likely unrelated.
Information source: bleepingcomputer.com
