Returned items
Posted July 16, 2026
In June, a small number of accounts were broken into.
Having your account emptied is one of the worst things that can happen here. If it happened to you: we're sorry, and it makes us angry too.
Every one of these accounts was taken the same way, through the lost-password flow. Whoever did this already had the account's email, asked us to reset the password, and the reset link went to that inbox.
So the one thing worth doing right now is changing your email password. Anyone who can read your email can reset the password on almost anything you own, here and everywhere else. Give it a password you don't use anywhere else.
Once they were in, they emptied the account. They listed everything in the account's own shop for a single point, bought it all through a throwaway account, and moved on to the next one.
We caught it, froze the accounts doing the buying, and reset the passwords on the ones that were broken into.
Then we read back through the shop logs and rebuilt a list of what left each account. Most of those items had already been resold to people who bought them fair and square, so we left those buyers alone. Everyone who was hit gets a fresh copy of what was taken instead.
Stolen gift cards work a little differently. Instead of new cards, we put the Cash Shop Credits straight onto your account, so you can buy cards again or spend the credits how you want.
Was your account affected?
Log in to see whether anything was taken from your account and what's coming back.
Across every account that was hit, we're returning 52,339 items and 326,300 Cash Shop Credits. We worked backwards through the logs to get this as close to whole as we could.
If something's missing here that we didn't catch, open a ticket and we'll help as soon as we can.