Multiple EpicNPC users are being hacked???

[The Integrity]

I received an email with a code all of a sudden, even though I did not try to log in anywhere.

I tried to access the forum at this point, but I was now asked for a code, even though I already had epicnpc open in 3 tabs. I typed in the code and confirmed it, but then received an error that this device was already authenticated.

What happened? I doubt that anyone found out my password, but it still scared me. I changed it just in case. My computer is not compromised.

EDIT:
Someone is accessing the accounts of multiple users!

Accessed accounts so far:
https://www.epicnpc.com/members/283059-The-Integrity
https://www.epicnpc.com/members/117848-Eu-Accounts-com
https://www.epicnpc.com/members/384375-Goldprovider
https://www.epicnpc.com/members/361823-Enforcer
https://www.epicnpc.com/members/377164-Rohan
https://www.epicnpc.com/members/408477-L-1nk

 

[doomedtofail]

Someone has access to your account. Change all your information from a clean computer

 

[doomedtofail]

But they cannot post because they cannot get into your email. I would change the email password to just in case. A couple accounts got linked

 

[doomedtofail]

Person was able to log into 3/4 accounts here. So someone is compromised. He had your password. I closed 3 accounts for security reasons they need to verify themselves to support email. I do not know if anyone of the 3 accounts is the perpetraitor or not. Only one was able to post at all. [L]ink has a post that says "i suck ****" which i can only assume was the person hacking.

 

[The Integrity]

How could he obtain my password?
I'm pretty sure I wasn't hacked.

Oh my god 3 multiple accounts???

 

[doomedtofail]

They logged into your account. They have your password.

 

[The Integrity]

Ok now I can confirm that I wasn't hacked. I checked both of my computers thoroughly. None of my other services were accessed, only epicnpc.

Also, the password that I used was used for epicnpc and my Paypal account. I'm pretty sure that he would target my paypal account first, and not a forum account... I even had money there.

User Goldprovider contacted me on skype and told me pretty much the same story. Only his epicnpc account was compromised. He also wants an unban.

- - - Updated - - -

Another account was just accessed: https://www.epicnpc.com/members/117848-Eu-Accounts-com

 

[doomedtofail]

He needs to contact support And prove his identity. He was hacked one way or another

 

[The Integrity]

I contacted https://www.epicnpc.com/members/117848-Eu-Accounts-com and it's the same with him. Only epicnpc account was accessed.

Maybe the database or part of it was hacked? Or maybe it was hacked before, but the hacker is using the info now?

 

[doomedtofail]

On most of the accounts he cannot post because he cannot get into emails. At least one of them the epicnpc account and email passwords were the same. But not knowing any of those people we cannot risk it they can contact mike via email to verifiy identity.

I rather inconvience a few sellers for a little to prevent a scam or two. I doubt he stole the account information to just write "i am a ****" in their threads.

We had a few accounts a few weeks ago too.
I cannot say this is related or not.

And as far as data base hacked, i doubt but anything is possible just make sure you change your epicnpc password and email password, and skype just in case

 

[The Integrity]

When you log in and it asks you for the code, does it tell you your email address?
I'm glad I didn't put paypal on my main email, would have been screwed so much now.

My email is protected by phone authenticator (that's why I'm not using it on epic), so no way to enter even while knowing the password.
I really can't find an explanation on how he managed to get our passwords.

 

[doomedtofail]

I do not know either. But I cannot risk it at this point. I am sorry for those stuck in limbo

 

[doomedtofail]

Right now I can see that the one account was logged into and successfully posted on an ip from ISP: Optimum Online in the bronx, ny and that user is from ukraine.
Right now there are not users registered that address and no other posts from that Address, But at this time I cannot tell if they could not post due to lack of access to the emails or I closed them fast enough.

 

[Geek]

It's likely a hacker targeting users, the site itself is secure. They may have been phished since no passwords were reset.

A normal virus scan will not detect a fud (fully undetected) infection. Download and run RKILL and then reboot in safe mode and run malwarebytes system scan.

- - - Updated - - -

Right now I can see that the one account was logged into and successfully posted on an ip from ISP: Optimum Online in the bronx, ny and that user is from ukraine.
Right now there are not users registered that address and no other posts from that Address, But at this time I cannot tell if they could not post due to lack of access to the emails or I closed them fast enough.

If you care to share the attackers IP with me privately I can dig a little deeper than you guys may be able to.

 

[doomedtofail]

Sometimes also helps if you are running different programs when scanning. for instance game account, internet browser, etc as sometimes code may be set up to only activate when certain actions are taken

 

[doomedtofail]

We have also seen hackers access peoples skypes and use information they get from chat to attempt to access other peoples accounts, ie other skypes or epicnpc. It could be as simple as person gained access to a skype you sold an account to and that password happened to match your epicnpc password or skype password. Make sure you never use the same password for anything other then your epicnpc account. Not likely in this case due to so many random users, but it is not worth the risk.

 

[EpicNPC]

I'm investigating this now.

Even if someone accesses another member's account, then can't do anything without the security code sent to your email.

For additional security you can add a phone authenticator, which is free. This way the security code is on your phone and even if your email is also hacked, your Epicnpc will remain secure.
https://www.epicnpc.com/infocenter/upgrades.html