Edit: May 2, 2017
On April 30, 2017 Unity forums were hacked and some users were sent emails via the Unity Forum messaging system.
The email sent is below with redacted information for the purpose of not promoting the group responsible.
https://www.reddit.com/r/Unity3D/comments/68l7ik/unity_forum_hack_update/
https://www.reddit.com/r/Unity3D/comments/68htdw/unity_forums_hacked/
1 Like
You might want to remove that email address fro your post.
Also, it explains why unity forums were in maintenance mode for half of a day.
Just a friendly reminder that while it is always a good idea to change your passwords after a breach, that in general you want to wait to do so after you are sure that the hackers don’t have a presence on Unity servers anymore or they might intercept your change. Especially since they are clearly not white hats as they claim and specifically asked you to do so.
If you are password sharing between websites, obviously you shouldn’t, but you should obviously change all the other websites that share that password immediately.
From what I read the only thing they did wrong was not following responsible disclosure, did they do something else?
@LaneFox : Thanks for the links they make for a good repository on this subject.
Unless I am reading it wrong that email belong to the hacker group. So nuts to them.
Other then the hackers themselves, no one knows what they have or haven’t done once breaching the servers. So the list of what they’ve done may be long or short. But from what we know they:
- Didn’t follow disclosure protocol
- Actually breached and took over the website
Either of these clearly shows they are not white hats, grey hats at best, or more likely black hats. White hats are great and if they follow the protocol of notification to the company with how many days before the public is notified (not website taken over) is a great service for us all. Black hats are definitely bad. Grey hats it’s debatable but there isn’t really any ground to stand on unless protocol has been followed first and ignored.
1 Like
That group is on record in interviews saying they are selling customer data to criminal organizations. They are crooks, no need for debate.
My assumption is that they did this in an attempt to gain access to user payment information. We have the asset store and now Unity as a service. That’s two payment sources with a huge pool of users. When this wasn’t secussfull they just resorted to vandalism of the site.
Still If you have a credit card on file with Unity just watch it a bit more closely. If you use PayPal your probably fine.
Precisely. That’s why I recommend to remove it. No need to advertise anyone. Especially if:
Your right it could be seen as a victory mark. Removed.
They basically tried to hold the site to ransom. When I first tried to access it yesterday morning every page was replaced with a banner. It basically said “Come visit our site and pay us money to get your site back”.
That makes them malicious in my book.
That’s strange, I haven’t received an email from them. Could be probably because I signed out from newsletter 
Wait, I thought they only hacked forums, asking owners (Unity) to contact them to restore forums. Didn’t know they actually help Unity website for ransom.
The Unity forums were up for ransom, the rest of the website was fine.
It was somewhat disturbing to me to realise how many times a day I log into this place 
A strong (and unfortunate) reason the Internet and whole digital age thing can never really reach its full potential. Every time people become (near) fully relaxed using it crap like this happens to put everyone on guard again. Another plus for my grand plan to one day “go off the grid”.
1 Like
That’s strange. I saw a banner yesterday, but no sign of them saying that they were holding forums for ransom.
You have like 13,000 posts and I joined weeks before you
Honestly it’s not as bad as it seems. Remember Unity doesn’t exactly have a track record for web development. After the entire fiasco with that broken forum software we had I’m not at all surprised that they got themselves hacked and it’s good to see that they’ve acknowledged in their blog post that they had a security problem.
One thing this has encouraged me to do though is start looking into a password manager so I can use tougher passwords without the risk of forgetting what they are. I already use random strings of characters for my web hosting passwords but I’m thinking of using them for everything now.
3 Likes
Oh yeah I get that. Other than here I use a pretty strong password as well. But sometimes I just get tired of it all. Tired of even thinking about all of these thieves. lol
It’s like the morons running around stores with cc readers in their pockets. Just this new wave of thieves make me sick. At least the ones from decades ago had the guts to pull a knife or a gun (granted still a very cowardly thing but still in person instead of hiding in the shadows). It be different if it was just more bold in real life then we could kick their ass. But no this modern thing… the Internet makes everyone feel like a Billy Bad Ass becauae they can hide. [/end of rant]
1 Like
I’ve been thinking that for a while now. The main roadblock for me is the sheer number of devices I use my passwords on.