A collection of over one million accounts for Stalker Online containing private information is claimed to have been sold to hackers on the dark web.
Stalker Online is a post-apocalyptic MMO that’s popular in Russia, Eastern Europe, and some circles in the US. This third-person post-apocalyptic MMO is seen as a spiritual successor to the popular S.T.A.L.K.E.R. franchise. Since the first server went online in 2012 it’s slowly built up a dedicated fanbase with millions of accounts.
According to Cybernews, a large number of those accounts are currently being peddled on various hacker sites on the dark web. At least 1.2 million player accounts and more than 136 thousand Stalker Online forum accounts have been collected and sold.
The accounts were stolen from a database containing information such as the player’s passwords, usernames, email handles, phone numbers, and even IP addresses. Cybernews says they discovered the hack on May 5th when they stumbled across the database in its entirety for sale on a hacker forum.
The hacker took credit for the theft by posting on one of Stalker Online webpages with a link stating that they had the files. They also posted a contact link so those who’d been hacked could get in contact with the hacker, likely for ransom purposes. The hacker threatened that anyone who didn’t make contact in 24 hours would have their information posted publicly.
Cybernews claims that part of the reason the database was hacked was due to ineffective security. They pointed out the information on the database were protected via a “MD5 hashing algorithm and salted” which they state isn’t too hard to crack.
While they were able to get the database pulled of the site, it had been up and available for sale for at least a month. It’s likely that a number of people were able to purchase and have access to the information in that time.
Fortunately for players, the information stolen did not contain credit cards numbers, bank account info, or anything of a similar sensitive nature. But with the email addresses, usernames, passwords, and other info, hackers would be able to hold the accounts ransom, launch convincing phishing efforts, and possibly hack into other accounts that might use similar usernames and passwords.
While this particular hacker site removed the information, it’s likely that others could have purchased the information and posted it on separate sites for resale. For those who play Stalker Online it’s highly encouraged to change passwords for both that account and any other accounts that may use the same password.