Epic Games warns that email addresses have been stolen in forum hack

Epic Games has issued a warning saying that the Unreal Engine and Unreal Tournament forums have been hacked. However, only email addresses were allegedly stolen, because passwords are stored in a different location.

Epic Games writes that in addition to email addresses, other entered data was also stolen, but does not provide further details. It further states that no passwords have been “leaked in any form, including salt or hash, and no plaintext.” Therefore, the forums would remain online and users should not have to reset their passwords.

ZDNet previously reported, based on information from the site Leakedsource, that more than 800,000 accounts were stolen by a SQL leak in outdated vBulletin software. However, the message in question has since disappeared from the Leakedsource site. Epic Games itself does not provide information about numbers. According to Leakedsource, in addition to email addresses, it included passwords, IP addresses, dates of birth, and access tokens for Facebook. However, the passwords would not be easy to crack. It therefore appears that Leakedsource removed the information after Epic Games’ message.

The studio behind Unreal Tournament also states in the relevant warning that users who have used the forums of, among others, Blade, UDK, former UT games and Gears of War since July 2015 must change their passwords. The forums would also have been hacked, with hashed passwords with salt leaked out. Due to the wording of the message, it is unclear whether Epic Games is referring to an earlier hack, which became known on July 15, 2015, or whether the forums have been hacked again.

Games such as Paragon, Fortnite, Shadow Complex and SpyJinx are not affected, according to the studio. Recently, data from other forums based on the vBulletin software also leaked, including Dota 2, Clash of Kings, and Ubuntu.