A hacker has bombarded OneBookShelf’s DriveThruRPG and DM’s Guild sites with login attempts using password and email combinations gathered gleamed from unrelated sites. It’s the classic scenario wherein security experts advise you to use different passwords on different sites.
OneBookShelf has confirmed that some accounts have been affected and the hacker has been able to withdraw money. The retailer has contacted everyone affected.
OneBookShelf has also confirmed they will be reimbursing whatever funds have been lost during the hack.
A statement from the company said;
Yesterday morning a hacker accessed multiple accounts on DriveThruRPG, DMsGuild or other OneBookShelf site and succeeded in withdrawing earnings from account balances to the hacker’s own PayPal accounts.
At this time, we believe the hacker was using a database of email/password credentials stolen from other site(s) and attempting to see if the same email had an account on our site as well and if such account used the same password on our site. An extremely large network of “zombie” devices have been used in this attack to deluge our site with such log in attempts. It would seem that the hacker got a match on a few accounts and therefore successfully logged in as the publisher/author and withdrew funds from the author’s OneBookShelf account.
To be clear, there is zero evidence that our database or servers were hacked or compromised. Only certain customer accounts were logged into and funds fraudulently taken from those accounts.
Sites do not always reimburse money when accounts are ‘compromised’ by a hacker knowing a successful password and login combination.
Publishers and affiliates first suspected a problem when it becomes impossible to withdraw money from OneBookShelf accounts. The retailer temporarily suspended their withdrawal functionality as part of their defence against the malicious attack on their systems.
OneBookShelf has communicated the news to publishers but is yet to make a wider public announcement on what is probably still a live situation.
Take part in the Geek Native community by leaving a comment below.
