Warframe warframe.com Warframe data breach: what happened and what to do
In November 2014 the game Warframe was hacked, exposing about 819,000 unique email addresses, usernames and website activity. It came to light in 2016. Digital Extremes, the developer, said payment details and real passwords weren't taken.
View all 13,115 breaches- Breach date
- 24 Nov 2014
- Affected
- 819,478
- Data exposed
- Email addresses, Usernames, Website activity
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In November 2014, attackers broke into the website behind the online game Warframe. Have I Been Pwned (HIBP) lists 819,478 unique email addresses from the incident, along with usernames and website activity such as account creation and last login dates. The breach only became public in July 2016, when Motherboard reported on it after getting a sample of the data.
How it happened
The attack is believed to have used a SQL injection flaw in Drupal, the content software the site ran at the time. Drupal patched the flaw about two weeks after the intrusion. The stolen data had a "pass" column that looked like salted password hashes. Digital Extremes, the studio behind Warframe, said those values were placeholder "alias names" and not real passwords, and HIBP notes that claim.
What this means for you
Email addresses and usernames are enough for phishing. A message that mentions Warframe and a username you really used is more convincing than a generic one. If you reused your Warframe username on other sites, someone can also guess where else you have accounts.
The breach is old, so most affected people have long since changed their details. It's still worth a quick check, because a leaked email address stays in circulation for years.
The company's response
Digital Extremes replaced the Drupal setup with a custom website system that no longer stores account information, and added two-factor authentication. It also advised players to change their passwords.
What to do if you were in it
- 1
Change your password and any copy of it
Change your Warframe password, then change it on every other account where you used the same or a similar one. Digital Extremes says real passwords weren't taken, but changing them costs you two minutes. Turn on two-factor login where it's offered, and use a password manager so each account gets its own password.
- 2
Expect phishing that uses real details
With your email address and username in circulation, scammers can send emails or texts that look personal. Don't click links in unexpected messages, and go to the company's site directly instead.
- 3
Turn on two-factor login on the account
Digital Extremes added two-factor authentication after the breach. Enable it in your Warframe account settings.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It checks breach databases for your email, phone and other details, and Serus alerts you when they show up in a new leak.
Frequently asked
Was I affected by the Warframe breach?
HIBP lists 819,478 unique email addresses. Search your email on Have I Been Pwned or run a free Serus scan to see whether yours is one of them.
What was exposed in the Warframe breach?
Email addresses, usernames and website activity. Digital Extremes said payment details weren't taken and that the "pass" values were alias names, not passwords.
Should I change my Warframe password?
Yes, if you haven't since 2014, and change it anywhere you reused it. It's cheap insurance even though the company disputes that real passwords leaked.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
