We are currently investigating a security incident affecting Board Game Arena.
Some users may have encountered unexpected pop-ups while using the platform. We have identified unauthorized code involved in this behaviour, and our technical team is actively investigating its origin, scope and potential impact.
At this stage, the investigation is still ongoing. We do not yet have enough verified information to provide further details, and we want to avoid speculating before the technical analysis is complete.
We can confirm that payment card information was not exposed through this incident, as Board Game Arena does not store users’ payment card details on its systems.
If you encounter any unexpected pop-up or unusual behaviour on Board Game Arena, we recommend closing it without interacting with it and refreshing the page.
We will update this post as soon as we have confirmed information to share.
Thank you for your patience and understanding while our team investigates.
Update - October 26 - 16:30 CEST
We have made good progress and can confirm that the unexpected pop-ups seen by some players were caused by unauthorized activity.
The code responsible for these pop-ups has been removed, and additional measures have been taken to secure our systems.
Our review is still ongoing. We are continuing to assess the scope and potential impact, and we do not want to speculate before our checks are complete.
We can also confirm that payment card details were not exposed, as Board Game Arena does not store this information on its systems.
We will share further information as soon as we are able to provide confirmed details.
Thank you again for your patience and understanding.
Update – October 28 - Time 17:30 CET
Thank you for your patience while we investigated the incident that occurred over the weekend. We understand that transparency is essential, and while our investigation is still ongoing, we want to share the following update with you.
What happened
Our investigation confirmed that an unauthorized third party found a way into our developer platform (known as the BGA Studio) They installed malicious code on one of our servers, which caused some players, mainly on mobile, and in certain countries, to see unwanted pop-up ads.
We identified and removed this code on October 26. We have since further reinforced our monitoring, updated our access controls, and launched a full infrastructure review to permanently close the exploited vulnerability.
What is affected
No payment card information was compromised. As mentioned previously, BGA does not store card details on its system.
We found no evidence that our broader player database was accessed, copied or extracted. Rest assured that we continue to monitor the situation actively.
What we’ve done
We removed the malicious code and took necessary steps to remediate unauthorized access. We also changed potentially affected login credentials and security keys. We are continuing to review our infrastructure to identify any further measures needed.
In line with our regulatory obligations, we are in the process of reporting the incident to the relevant data protection authorities.
What’s next
We are continuing our investigation to ensure that nothing more than the above was affected. We will keep you informed if any new, relevant information concerning this issue comes to light.
If you have any specific concerns regarding your personal data, please contact our Data Protection Office (dpo@boardgamearena.com).
Our objective is to remain transparent with our community. Thank you for your patience and understanding.
Some users may have encountered unexpected pop-ups while using the platform. We have identified unauthorized code involved in this behaviour, and our technical team is actively investigating its origin, scope and potential impact.
At this stage, the investigation is still ongoing. We do not yet have enough verified information to provide further details, and we want to avoid speculating before the technical analysis is complete.
We can confirm that payment card information was not exposed through this incident, as Board Game Arena does not store users’ payment card details on its systems.
If you encounter any unexpected pop-up or unusual behaviour on Board Game Arena, we recommend closing it without interacting with it and refreshing the page.
We will update this post as soon as we have confirmed information to share.
Thank you for your patience and understanding while our team investigates.
Update - October 26 - 16:30 CEST
We have made good progress and can confirm that the unexpected pop-ups seen by some players were caused by unauthorized activity.
The code responsible for these pop-ups has been removed, and additional measures have been taken to secure our systems.
Our review is still ongoing. We are continuing to assess the scope and potential impact, and we do not want to speculate before our checks are complete.
We can also confirm that payment card details were not exposed, as Board Game Arena does not store this information on its systems.
We will share further information as soon as we are able to provide confirmed details.
Thank you again for your patience and understanding.
Update – October 28 - Time 17:30 CET
Thank you for your patience while we investigated the incident that occurred over the weekend. We understand that transparency is essential, and while our investigation is still ongoing, we want to share the following update with you.
What happened
Our investigation confirmed that an unauthorized third party found a way into our developer platform (known as the BGA Studio) They installed malicious code on one of our servers, which caused some players, mainly on mobile, and in certain countries, to see unwanted pop-up ads.
We identified and removed this code on October 26. We have since further reinforced our monitoring, updated our access controls, and launched a full infrastructure review to permanently close the exploited vulnerability.
What is affected
No payment card information was compromised. As mentioned previously, BGA does not store card details on its system.
We found no evidence that our broader player database was accessed, copied or extracted. Rest assured that we continue to monitor the situation actively.
What we’ve done
We removed the malicious code and took necessary steps to remediate unauthorized access. We also changed potentially affected login credentials and security keys. We are continuing to review our infrastructure to identify any further measures needed.
In line with our regulatory obligations, we are in the process of reporting the incident to the relevant data protection authorities.
What’s next
We are continuing our investigation to ensure that nothing more than the above was affected. We will keep you informed if any new, relevant information concerning this issue comes to light.
If you have any specific concerns regarding your personal data, please contact our Data Protection Office (dpo@boardgamearena.com).
Our objective is to remain transparent with our community. Thank you for your patience and understanding.
