Star Vault - Mortal Online Hacked

On July 4th, 2018 we received a support ticket by an anonymous user claiming to have obtained access to all databases that belong to a Swedish based game development company known as “Star Vault AB (publ)“. The user, going by the chat handle “Instakilla”  (a Penetration Tester, And Web Developer) offered DeHashed a copy of the data to spread awareness of the breach. The user also appears to have complete access to all their content, including source code to all games produced by the company.

The company has issued a Data Breach Notification On June 17th. The note reads:

Data breach notification
On June 17th, 2018 we were notified that our databases might have been breached.

At that time, we cut access to the website from the outside and started an investigation.
We brought in an external person to look into what happened, and today we sadly must tell you that we have indeed been breached.
An unauthorized third party gained database access to one of our servers containing the shop and forum databases.
We immediately started working on fixing the vulnerabilities in the website to stop this from happening in the future.

We do not store any credit card information on our servers so that information is still completely safe.
The breach has been reported to the authorities, and collected logs have been sent to the police.

If you used a password on the forums or in the shop that you use on other sites, then change them immediately!
We also recommend that you change your account passwords.

If you have further questions, send us an email at info@starvault.se

This is not the first time the game company has been breached, in February of 2012 they were hit with a massive breach, and once again in April of 2015.

Here’s a full analysis of the breach,

The compromised data includes Usernames, Passwords, Forum Activity, Full Names, Emails, Birth Dates, Gender, Full Address, IP Addresses, Facebook Information and much more. Belonging to a total of  609,485 compromised account.

Passwords are stored in the very unsecure hashing method of MD5.

Along with the emails, the poorly hashed passwords that hackers are able to quickly decrypt are included. Here’s an analysis on that:

In conclusion, Star Vault games seems to have failed to protect it’s users for the 3rd time. They insisted on using weak hashing methods that now leaves their users at a greater risk than necessary. Had they used a better hashing method, users would have been somewhat safer, considering their personal data has been breached and is now being spread across the internet by hackers.

We at DeHashed have obtained a copy of the database, We will be notifying users if they have been affected with the next few hours.