🔒 Account Break-ins
In late June, a small number of (mostly inactive) accounts were broken into and stripped of everything they owned.
Every one of these break-ins happened the same way, through the lost-password flow. If there's one thing to take from this, it's to change your email password and use one you don't use anywhere else, because a compromised inbox is keys to all of your digital accounts.
Once they were in, they emptied the account. They listed everything in the account's own shop for a single point and bought it through throwaway alts, then moved on to the next account. We caught it, froze the accounts doing the buying after an investigation (and ensuring they didn't have access to any more accounts), and reset the passwords on the accounts that were broken into so they couldn't be touched again.
Then we went back through the shop logs and rebuilt, item by item, exactly what left each account. Everyone who was hit is getting a fresh copy of everything that was taken. Stolen gift cards come back as Cash Shop Credits rather than new cards, credited straight to the account. You can see your own list on the returned items page.
One honest note about custom wearables. Most of the stolen items had already been resold, at fair prices, to players who had no idea they were buying stolen goods. There were thousands of those sales, and unwinding them would only turn thousands of innocent buyers into new victims. So we left those purchases alone and gave the original owners fresh copies instead. That does mean a handful of custom wearables now exist in slightly larger numbers than they did before. Returning people's items is worth that to us, and I would make the same call again.
If you were affected and something still looks missing after all this, open a ticket and we'll help as soon as we can.
Every one of these break-ins happened the same way, through the lost-password flow. If there's one thing to take from this, it's to change your email password and use one you don't use anywhere else, because a compromised inbox is keys to all of your digital accounts.
Once they were in, they emptied the account. They listed everything in the account's own shop for a single point and bought it through throwaway alts, then moved on to the next account. We caught it, froze the accounts doing the buying after an investigation (and ensuring they didn't have access to any more accounts), and reset the passwords on the accounts that were broken into so they couldn't be touched again.
Then we went back through the shop logs and rebuilt, item by item, exactly what left each account. Everyone who was hit is getting a fresh copy of everything that was taken. Stolen gift cards come back as Cash Shop Credits rather than new cards, credited straight to the account. You can see your own list on the returned items page.
One honest note about custom wearables. Most of the stolen items had already been resold, at fair prices, to players who had no idea they were buying stolen goods. There were thousands of those sales, and unwinding them would only turn thousands of innocent buyers into new victims. So we left those purchases alone and gave the original owners fresh copies instead. That does mean a handful of custom wearables now exist in slightly larger numbers than they did before. Returning people's items is worth that to us, and I would make the same call again.
If you were affected and something still looks missing after all this, open a ticket and we'll help as soon as we can.
Posted by Keith
Jasper
I definitely think you made the right call. If some are upset at their artificial scarcity being ruined, so be it. It's a virtual item and current/unaffected players don't deserve to be victimized by current events. Thank you so much for caring about the average user and being fair to everyone.
@Keith I get notifications on my phone with each email, so I would be alerted to any potential retrieval process. I still think an optional PIN at login should be added, and I hope you will consider it.
Keith
STAFF
@brokensafety Unfortunately a pin wouldn't have helped in this situation. We need an avenue for people to get accounts back in the case they've lost or forgotten their PIN, and that process would happen over the email attached to the account. If they have access to your email, and can email us from it and navigate that process (Which this person seemed motivated to do), a PIN wouldn't have helped at all. In the case of someone getting someones PW, then a PIN would be useful.
@allnightforever Make a ticket and a UA can help you out 💗
@allnightforever Make a ticket and a UA can help you out 💗
Yikes! Why would someone be motivated to do something like this for something that's supposed to be fun?
Thanks to the team for watching out for us!
Thanks to the team for watching out for us!
Please consider adding an optional PIN at login to help curb break-ins for those of us who are uneasy without an extra barrier of protection. Thank you!
@allnightforever I'd sya open up a ticket just to be on the safe side, so that even if they don't see your comment here, you'll still get an answer.
Surely, doing all the investigating and item shuffling was not on your bingo card of things to spend lots of precious Subata-related time on... thank you so much for addressing the situation in the best way possible, so sorry you probably had so much other work that you wanted to focus on instead but had to pivot to this and address bad people doing bad things. We users truly do value your time and effort, it does not go unnoticed <3
Thank you to all the staff for identifying what was happening and working so hard to sort it out. Thankfully I've not been directly affected, but I still appreciate the effort Subeta team have gone to on this.
That's just crazy! Now I know why it took a while to get my account back during the reset. Mine wasn't affected but I understand the hesitancy of the staff member assisting me to give my access back quickly.
Is there a way to change email and/or passwords by creating a ticket or something? Because I'm currently having a problem with tutanota and cant send or recieve emails so i would be unable to verify the password change and really dont want this to happen to me ;-;
It's crazy to me that people do that kind of stuff! @User not found: _@ But thank you so much for all your hard work and resolving this so generously for everyone affected. :heart:
Thank you for the transparency and all your hard work on this. Can't believe it's 2026 and people are STILL so petty as to pull this crap :(
Thank you guys for always looking out for the users. I despise that this happened at all, and I'm glad it's been handled now, but I'm sorry for the trouble it caused! I remember seeing some craziness in shops there for a while, but I thought it was a couple shops clearing out some things, not a string of break ins.
I am so sorry to anyone who was affected by this. I do recommend a secure password stored in a secure way (not your browser) but how frustrating.
Oh no! Glad this was caught and fixed, I can't imagine the amount of work it placed on the team.
On the odd times when seeing a rare item suddenly drop to a cheaper price, I usually assume it's someone closing their account and basically giving things away. Especially when it's a one-off listing. But never like for 1 sp. Would never have suspected people basically laundering digital items..
On the odd times when seeing a rare item suddenly drop to a cheaper price, I usually assume it's someone closing their account and basically giving things away. Especially when it's a one-off listing. But never like for 1 sp. Would never have suspected people basically laundering digital items..
Oh my goodness. That's insane! Am incredibly glad the Subeta team is so talented to be able to trace all this kind of stuff. I can only imagine how bad it would feel to wake up one day with everything gone... Strong passwords people! Can't let the petty ones out there have it easy when it comes to security!
And the fact that you're returning all the items and csc to the users is unbelieveable. Really hard work and it shows how much you care <3
Thank you for all your hard work and transparency. It's not obvious at all.
Would you ever consider implementing 2FA?
Would you ever consider implementing 2FA?
I have several not safe for Subeta comments on this, even as one thankfully not hit by this, but I will say this and it is safe for Subeta: thank you for the hard work surrounding this and then to openly post about what has happened, it speaks volumes. Let's hope it's the last for a longer time and the cretinous fool gets smacked with a good shot of FO for their FA.
Is that why there was a sudden influx of custom wearables in the donation center and for super cheap? Huh. Well, glad that staff was able to more or less get things back as they should be. Keep up the good work!
good work! Hopefully the person responsible realizes theyre not welcome here if they cant play by the rules!
Thank you so much for considering all sides of this. I make a habit of going through my wishlist to see if any desired hard to get cws end up listed and i cannot even explain my excitement when i saw so many in a shop thinkin someone was quitting - ran to buy csc and as i was purchasing some cws from the shop (quite a few) the user was frozen and the items went to display only. I figured they were hacked and created a ticket offering to give back the items if this was the case, as dissappointing as that felt.
I find it really respectable that you considered how those who were able to get cws theyve had their eyes on for awhile would feel in this scenario as well - solidified the fact that I will not be quitting as long as this site exists. Thank you!
I find it really respectable that you considered how those who were able to get cws theyve had their eyes on for awhile would feel in this scenario as well - solidified the fact that I will not be quitting as long as this site exists. Thank you!
Oh jeez. I think I bought something from one of those accounts - a short while ago I bought a "Yellow Present Cookie" from a shop for only a couple SP that I picked up while updating my SubetaLodge foods for my pet. I kept the cookie for a couple days just in case the owner didn't intend to sell it for so low, but I eventually figured maybe they were doing a clean out of their stock and just wanted stuff gone so I fed it to my main :(
Like others I also saw a few rare items have their last sale price at ~1sp, but I figured the same thing - people cleaning out old stock, or a quick way to throw items to friends or something instead of using trades. The thought that anyone could target a pet site of all places didn't even cross my mind.
As usual thank you for the transparency and for all the hard work you guys have put in, both now and in the past <3
Like others I also saw a few rare items have their last sale price at ~1sp, but I figured the same thing - people cleaning out old stock, or a quick way to throw items to friends or something instead of using trades. The thought that anyone could target a pet site of all places didn't even cross my mind.
As usual thank you for the transparency and for all the hard work you guys have put in, both now and in the past <3
Thankyou for your hard work and for the transparency!! I appreciate everything y'all do for us <3
Genuinely, thank you for both your honesty and your hardwork. Bad actors are everywhere and it's not your fault when they go out of their way to breach security-- because any security can be broken if you're determined enough. Stay safe, everyone.
Crazy that people have the time and energy to do all of this for something that doens't really matter that much in the end.
Maybe this can also be a reminder to the rest of us users as well that sometimes we don't always know what's going on behind the scenes right away, stuff like this happening that could be causing delays because staff have to run around putting out fires instead of doing the fun parts of their jobs.
Maybe this can also be a reminder to the rest of us users as well that sometimes we don't always know what's going on behind the scenes right away, stuff like this happening that could be causing delays because staff have to run around putting out fires instead of doing the fun parts of their jobs.
I wasn't affected (thankfully) but wish to thank the staff for their efforts in this matter!
Halfway through the news story I knew exactly which account it was 😒 They were the reason I suggested that users we block shouldn't still be able to buy from our shops.
Anyway, thank you so much for making the effort to restore everything, Keith and staff. I hope I didn't buy any of the stolen CWs, or that ones I got in a giveaway weren't stolen :(
Anyway, thank you so much for making the effort to restore everything, Keith and staff. I hope I didn't buy any of the stolen CWs, or that ones I got in a giveaway weren't stolen :(
just changed my login stuff. this hit me and i lost over a thousand items accumulated over my time on the site. Thank you all for all the hard work to get our stuff back to us!
I just wanted to say thank you so much for putting in that hard work to restore all those items and credits to the affected accounts! It's things like this, where you and the team really show that you care about the site and the users both, that make me love Subeta so much. Restoring my belief in the good <3
> Across every account that was hit, we're returning 52,339 items and 326,300 Cash Shop Credits.
Woweee, what a heist! I appreciate that you guys went to the effort of chasing everything up, probably more thorough that most law enforcement.
Woweee, what a heist! I appreciate that you guys went to the effort of chasing everything up, probably more thorough that most law enforcement.
I was questioning a newwer account i kept seeing in my shop and when i viewed their it was an insane amount of rare items.... that makes so much sense and is so annoying thank you Keith and subeta team for going through all these steps and updating us when you could.
Wow, how ridiculous. Thank you for caring for your users, even the inactive ones.
Sad that this cost so much time and energy! :c
Sad that this cost so much time and energy! :c
Holy cow! I never saw any crazy prices so you guys must've caught a lot of it but that's so sweet of you to make those custom wearables to those who were affected <3 The world is so crazy right now and to have chaos come here too is heartbreaking. Thank you for all that you do guys!
I know my two cents means absolutely nothing coming from someone who just collects CWs and doesn't create, but I would rather there be 1,000 of an item than 10 if it means it's the right thing to do.
I know my two cents means absolutely nothing coming from someone who just collects CWs and doesn't create, but I would rather there be 1,000 of an item than 10 if it means it's the right thing to do.
This is crazy and very odd. Thank you for returning items and cash shop credits to those who are affected. That's very sweet ❤️
Oh wow that is crazy to hear -- and.. why?! So bizarre. Glad you were able to recover those users lost items & what not...
@Kieth Jerk it is then! Plenty of those in the world, Farside even did a comic.
Sorry you had to even deal with that, but thankful you took care of it and made good those who were affected. Unlike some other site that will remain nameless who years ago told a whole bunch of hacked users "too bad, start over" XD
Sorry you had to even deal with that, but thankful you took care of it and made good those who were affected. Unlike some other site that will remain nameless who years ago told a whole bunch of hacked users "too bad, start over" XD
Log in to leave a comment.