Over the past several weeks, there has been an exponential explosion of WoW Account Hacking. Thousands of accounts that haven't been active for years are suddenly being logged into, with Unauthorized Authenticators attached to their accounts, while items and characters are being stripped down to gold and deleted. Even live accounts are being stolen from users who have ample security measures in place or are even IT/Security specialists themselves.
Blizzard's phone support has not been available for weeks at a time ("Sorry, call back later.") as well.
There are outcries from victims on WoW Forums, but I found it strange that in almost all cases the victim was being blamed for the issue occurring. All of the haters (whose accounts were perfectly fine mind you) were blaming the victim for not securing their PCs or not protecting their account properly.
Yes, this does happen.. but there other ways accounts (just like credit cards) can be compromised that have nothing to do with the victim, their surfing habits, or their PC. What was strange about this specific case is that there were a lot of unanswered questions about this particular "explosion" of account thefts.. why was it happening to really old accounts without authenticators? Why such a large amount in such a short time?
But then I noticed something strange happening. Forum posts that were asking too many questions or ones where the user had absolute confidence in the security of their system were suddenly being deleted or locked. Specific posts were being targeted and deleted (e.g. victim confirms no keyloggers or phishing attempts, or they blame Blizzard for the issue), while the posts where the victim was being blamed for the issue were being left behind.
My suspicion was confirmed when someone posted a link on the WoW forums to one of my old lurking grounds: Blizzard is having major problems right now: Account Database has been breached, thousands of accounts impacted so far.
Funny.. I remember Reddit for having intelligent and playful conversation, but overall grounded in common sense. Something had changed though since I was last there and many comments were simply divorced from reality. They regurgitated the same old crap that I saw on the WoW Forums - "It's your own fault for not securing your PC." It's as if sanity was thrown out the window and they were brainwashed.
But it actually made perfect sense! And here's why:
Corporations are all the same (you'll know this if you've ever worked in one.) Blizzard is a corporation just like all of the others, they have internal squabbles, power plays, brown nosing, office politics, HR issues, sexual harassment, fraud/theft, etc. Every corporation goes through this, the bigger they are the more issues they have.
Note: Check out Glassdoor.com & Jobvent.com Blizzard Entertainment reviews if you want to hear from the employees themselves.
And what you probably already (should) know is that Blizzard works very hard and spends millions of dollars to control company perception. They're religious zealots when it comes to reputation management and they are so successful, in fact, that most gamers live under the impression that Blizzard is a mystical entity that's completely immune from problems. Not many companies can pull this off.
What people forget is that Blizzard employs (just like everyone else) Human Resources personnel, security, IT Security, and Fraud Specialists whose specific duties are to monitor and investigate internal employees for credit card theft and user account fraud (ie, unauthorized access to users' account details).
Understand that it can be quite difficult (almost impossible) for email/phone Customer Support, CS Forum Representatives, and GMs to access information. However, it can be quite easy (depending on skill level) for IT Support Staff, Database Administrators, Finance/Billing to access billing and gaming account information if they were so inclined.
You can learn a lot about a company by the careers/jobs that they offer! =]
Now, Blizzard's official policy has always been to just say "Check your home PC for security holes, that's where the problem is." But this script always reminds me of calling Technical Support and is a good demonstration of what separates user reactions in response to Blizzard versus other service providers.
For example, if you were to call Gateway/Dell/HP about computer hardware issues they'll ask if you changed any settings or installed new software, and ultimately try to blame the issue on you or forward you to another manufacturer. You don't buy it though, you know who is truly responsible and realize that they're just feeding you a line.
However, Blizzard indoctrination is so incredibly successful that when Blizzard Support tells you your account was hacked because of you, you completely believe them, blame yourself, panic about the security measures protecting your PC ("MS Security Essentials must not be enough!") and ultimately change all of your account passwords. Not only that, but you also get to suffer additional blame from the WoW forums and your online friends.
I actually admire Blizzard for this, they're doing a truly fantastic job! (I really mean this, their processes are as polished as their games.)
It's well known that Blizzard's internal organization and structure is kept hidden from the public eye, and corporate perception is controlled in news postings, employee policy, and heavily moderated forum posts. But, it's as if no one knows that Blizzard employs FRAUD SPECIALISTS for the specific task of investigating their own employees who steal credit card information and steal/sell accounts (which can be done in large quantities too.) That should be a big hint right there!
So let's review:
- Blizzard employees Fraud Specialists whose responsibilities include monitoring internal staff for account and credit card theft.
- Thousands of accounts have suddenly been hacked with Unauthorized Authenticator's attached.
- Many of the accounts hacked haven't been active in months/years. Users confirm that their computers are perfectly secured. In some cases, the users were security or IT specialists - well aware of the associated dangers and how to protect themselves.
- Forum posts are being deleted that denounce Blizzard, forum posts are being "promoted" that blame the user.
- Blizzard's response to all hacking incidents is for the victim to check and secure their PC.
Now, I'm not saying that all of these account hacking incidents were as a result of internal theft, but atleast be OPEN to the possibility that it's not always the users fault. (I know I keep re-emphasizing this... but they employ freaking FRAUD SPECIALISTS who investigate their own employees! It was on their career board!)
That's all I'm saying. They're employed for a reason.
It's typically a very small number of employees who engage in these types of activities and there are several methods to gain access to user accounts or credit card information.
Internally, it would be very easy to gain access to a large quantity of accounts depending on their skill level. I'd love to see their HR records and statistics regarding internal investigations, theft/fraud, etc. but like all other businesses, this type of information will never see the light of day. It happens in all businesses and as the economy falters, employee theft will be on the rise. I suspect that internal investigations can be rather challenging as well and difficult to prove.
Note: The reason I'm saying that it "WAS" on their career board was because shortly after my Reddit post talking about the Fraud Specialist positions at Blizzard, the job postings were suddenly removed from several job boards across the interwebs and even from the Blizzard Careers page itself. Coincidence? Maybe. But if you're interested, check out the Google cached pages for "Fraud Manager" or "Fraud Specialist".
Blizzard's new "Real ID" system has also now been announced. This will be a really good distraction from the ongoing account hacking issues that are currently taking place. That's probably an actual coincidence though, as it's been planned for a while. =]
