How is SE handling Hacked Accounts.

[Zane]

There's definitely something going on. Somehow a third party obtained the SE Member ID of myself and another Linkshell member, but must not have obtained our Passwords, as we were only locked out of our accounts for a few hours - we did not get hacked.

This is especially odd, as my SE ID is different from every other Username I have on any other site service. Furthermore, I use Firefox/NoScript/AdBlock as well as an updated version of Trend Micro. In the following post I will disclose all of the sites I've used in the past month since FF XIV came out (I'm very paranoid about my internet usage, and do not visit any site I have not been to before or is not a part of my daily routine unless I need to.)

Do not accuse those who got hacked of going to fishy sites. It is very apparent there is a leak in a third party source and these individuals were just unfortunate in not having a Security Token. What I want to know is, how did they get our SE ID to begin with?

[Zane]

FF XIV Lodestone (Old & New)
FF XIV Forums
SE Store
SE Account Page
xivdb
ffxivpads
My Free Company forums
daevaofwar
bluegartr
valk.dancing-mad
Facebook
Kotaku
CNN
Huffington Post
Daily Show
Colbert Report
AOL.com
AOL Mail Client
MangaPanda
Hulu
anilinkz
Trufit Student Loan
Drexel.edu
Drexel One
Youtube
Dropbox
dndtools
d20SRD
Wikipedia
Dorkly
Serebii.net
Gamestop
Bestbuy

None of these sites share my login or password for my SE id. As you can see, most of them are very reputable as well. There exists the possibility that somehow a virus or keylogger made it past No Script, Adblock, and my TrendMicro Anti-virus and has not been picked up by current definitions, but I also feel that is highly unlikely.

[Tupsi]

Authenticator is your best friend, seriously, you have to TRY to get hacked if you have one.

No, you simply need your session hijacked.

[C-croft]

Another trend is they may have jacked account info from another MMO and attempted to use it in FFXIV. This also works for hijacking accounts.

[Lyris-Lyanther]

Just out of curiousity, how many of those who have been hacked are on computer and how many are on ps3? Id like to see how those numbers broke down.

[Ryios]

... They don't need to share a password with your SE ID. What I said is a password shared with your EMAIL ADDRESS. The email you used to sign up for this game, is it Gmail, Hotmail, Live, etc etc etc ? If it is, is the password you use to check your email the same as any of those sites you visited? if it is, and you went there, you gave them your email credentials. Which they then used to find your SE ID, which they then used to reset your password for your SE Account (which was sent to you email, that they have access to) and then they can log in as you.

[Zane]

If you're referring to me, the Password I use for my E-mail is also unique.

I won't lie and say every password I have for every username is a unique and beautiful snowflake of perfect security, but the passwords I use for my SE account, E-mail, and Facebook are all unique and unlike any other password I use for any other service.