DriveThruRPG Hacked

Companies and websites getting hacked is a pretty regular occurrence these days (I've been notified just today of two breaches of companies I'm a customer of - the other is a mobile phone company). The latest victim is DriveThruRPG (also known as RPGNow), which has sent out emails to those who have made a card payment on the site since July 6th, as well as those who have their payment details stored on the site. The company has sent an email to both groups of customers. If you've used DTRPG or RPGNow in the last month or so, or if your details are stored there, be sure to check that there are no unusual transactions on your account.

The email reads:

Dear customer,

I regret to inform you that one of our servers suffered a security breach which may have compromised your credit card information.

You are receiving this email because you elected to store your credit card number on our server for future purchases. We store these numbers encrypted on our site, and we have no evidence the stored numbers were compromised during the breach. It is possible, however, that the encrypted numbers could have been copied and un-encrypted. We do not store your CVV code (the digits on the back of your credit card), making it difficult for the hacker to use your card number for online fraud. So while we think the data was not compromised, we wanted to inform you of the possibility. It would be safest if you contact your credit card issuer and ask for a replacement card. At the very least, you should check your card for any suspicious charges occurring on or after July 6th.

Our technical team has identified the issue and has secured our servers. Our websites are once again safe to use.

Information such as your name and email address were potentially compromised as well.

Login passwords are stored encrypted with a one-way hash and cannot be decrypted. You do not need to change your account password, but you are more than welcome to do so on your Account page at any time if you wish.

We are truly sorry this incident occurred and sincerely regret the inconvenience it causes you. Navigating credit card company call center menus is no one\'s idea of a good time.

Security has always been our top concern and up until this incident we were proud of our security record at . We will continue to do everything we can to keep our marketplace secure going forward.


​

Another version of the email, sent out to a different group of customers, has a different first paragraph:

You are receiving this email because you made a purchase (or attempted to make a purchase) on our site using a credit card between July 6th, 2015 and the morning of August 6th, 2015. There is a 50% chance that hackers were able to collect your credit card information. We recommend that you contact your credit card issuing bank and ask them to replace any cards that you used for charges on our site, and also look over your most recent statements for any suspicious charges.
​

You can find more information on the website's support page.

 

[gamerprinter]

2 things for me. 1 - I use Paypal and not credit cards with DTRPG (until Paypal gets hacked). 2 - I very seldom make purchases there, perhaps only 4 times a year, and haven't made any purchases since April, so I wasn't making purchases during the hacked period. I spend most of my weekly visits to DTRPG uploading products for sale and checking on status of sales as a publisher, which has no purchase/credit card requirements. I'm most often a seller not a buyer on DTRPG these days.

 

[thom_likes_gaming]

Anyone else not able to log into DTRPG? I even went so far as to request a new password, but no reply in like 30 minutes...

 

[Maggan]

I am able to log in.

/M

 

[Deathstrike]

Sheesh. The email drivethrurpg sent claimed that there's a 50% chance that my account information has been compromised. There's something ironically Gygaxian in that- I think drivethrurpg just asked me to roll d% to see if thieves stole my money.