Dear Developers,
Following the recent security incident involving the BGA Studio, I am writing to provide you with a clear update regarding the situation and how it impacts you as part of our developer community.
We understand that transparency is essential, and while our investigation is still ongoing, we want to share the following information with you.
What happened ?
An unauthorized third party injected malicious code on one of our servers, which led to the display of unwanted pop-up ads and some leaks related to the personnal informations of some developpers accounts that were accessed.
We identified and removed this malicious code on October 26. We have since further reinforced our monitoring, updated our access controls, and launched a full infrastructure review to permanently close the exploited vulnerability.
Is the BGA Studio still closed ?
The studio platform was secured immediately following the incident. We have taken the necessary steps to ensure that the environment is safe for development and publishing activities, the studio is no longer closed.
How do I know if I was affected ?
A limited number of developer accounts had information accessed, including account names, email addresses and part of your SFTP credentials.
If your account was specifically impacted, you have already been contacted individually via email with clear instructions.
Is this related to recent PHP2Shell vulnerabilities ?
No, this incident is entirely unrelated to any recent PHP vulnerabilities reported in October.
Evidence and scope
As mentioned, the impact was contained to a specific portion of the Studio developer platform. We have no evidence to date that our broader data set was accessed or extracted.
For security reasons, we will not share granular technical details regarding the exploit while our internal investigation and the reporting process to the data protection authorities are ongoing.
Next steps
We are continuing our investigation to ensure no further areas were affected. We will update you immediately if any new, relevant information comes to light.
If you have any specific concerns regarding your personal data, please reach out to our Data Protection Officer at dpo@boardgamearena.com.
Thank you for your continued commitment to the BGA community.
Best regards,
BGA Team.
Following the recent security incident involving the BGA Studio, I am writing to provide you with a clear update regarding the situation and how it impacts you as part of our developer community.
We understand that transparency is essential, and while our investigation is still ongoing, we want to share the following information with you.
What happened ?
An unauthorized third party injected malicious code on one of our servers, which led to the display of unwanted pop-up ads and some leaks related to the personnal informations of some developpers accounts that were accessed.
We identified and removed this malicious code on October 26. We have since further reinforced our monitoring, updated our access controls, and launched a full infrastructure review to permanently close the exploited vulnerability.
Is the BGA Studio still closed ?
The studio platform was secured immediately following the incident. We have taken the necessary steps to ensure that the environment is safe for development and publishing activities, the studio is no longer closed.
How do I know if I was affected ?
A limited number of developer accounts had information accessed, including account names, email addresses and part of your SFTP credentials.
If your account was specifically impacted, you have already been contacted individually via email with clear instructions.
Is this related to recent PHP2Shell vulnerabilities ?
No, this incident is entirely unrelated to any recent PHP vulnerabilities reported in October.
Evidence and scope
As mentioned, the impact was contained to a specific portion of the Studio developer platform. We have no evidence to date that our broader data set was accessed or extracted.
For security reasons, we will not share granular technical details regarding the exploit while our internal investigation and the reporting process to the data protection authorities are ongoing.
Next steps
We are continuing our investigation to ensure no further areas were affected. We will update you immediately if any new, relevant information comes to light.
If you have any specific concerns regarding your personal data, please reach out to our Data Protection Officer at dpo@boardgamearena.com.
Thank you for your continued commitment to the BGA community.
Best regards,
BGA Team.