Path Of Exile 2 hacker temporarily hijacks dozens of player inventories via admin account

rockpapershotgun.com:

A recent spate of forced password resets in Action RPG Path Of Exile 2 was acknowledged by developer Grinding Gear Games on Sunday, after a hacker gained access to an administrative account. As reported by 404 Media, this follows several reports on the game's forums and social media from players who'd had their inventories emptied of rare items.

“We totally fucked up here,” said game director Jonathan Rogers on a podcast with GhazzyTV, explaining how the hack began with a compromised Steam account linked to an administrative account on the game's website - effectively giving the hacker the same access as customer service, said Rogers. This allowed the hacker to reset passwords and log in as other players.

The next bit involves the sort of granular detail 404 Media are obviously much better at explaining than me, so I'm just going to quote them.

Ordinarily, whenever a member of Path of Exile 2’s support staff makes a change, that event is added to a list for potential later auditing. But when it came to resetting passwords, a bug meant that change was saved as a “note” and not an event, Rogers said. The hacker was then able to delete the note saying a password had been changed, an apparent attempt by the hacker to cover their tracks too. Because of this, it wasn’t immediately obvious to GGG what was happening with these account compromises, Rogers said.

“66 notes were deleted, so that would imply that 66 accounts were compromised,” Rogers said, although caveated that GGG only keeps logs for 30 days. Interestingly, the compromise “was all prelaunch of POE2,” Rogers said, meaning that the hacker gained access before the game was even available to the public.

404 mention these incidents echo other reports of items being stolen in December, but it does sound like it's all been caught and sorted now, with Rogers considering introducing two-factor authentication to player accounts after rolling it out for support accounts in the wake of the incident.

I've personally been