Board Game Arena

We are currently investigating a security incident affecting Board Game Arena.

Some users may have encountered unexpected pop-ups while using the platform. We have identified unauthorized code involved in this behaviour, and our technical team is actively investigating its origin, scope and potential impact.

At this stage, the investigation is still ongoing. We do not yet have enough verified information to provide further details, and we want to avoid speculating before the technical analysis is complete.

We can confirm that payment card information was not exposed through this incident, as Board Game Arena does not store users’ payment card details on its systems.
If you encounter any unexpected pop-up or unusual behaviour on Board Game Arena, we recommend closing it without interacting with it and refreshing the page.

We will update this post as soon as we have confirmed information to share.
Thank you for your patience and understanding while our team investigates.


Update - October 26 - 16:30 CEST

We have made good progress and can confirm that the unexpected pop-ups seen by some players were caused by unauthorized activity.

The code responsible for these pop-ups has been removed, and additional measures have been taken to secure our systems.
Our review is still ongoing. We are continuing to assess the scope and potential impact, and we do not want to speculate before our checks are complete.

We can also confirm that payment card details were not exposed, as Board Game Arena does not store this information on its systems.
We will share further information as soon as we are able to provide confirmed details.

Thank you again for your patience and understanding.

I saw this yesterday and if it's what I saw (something like 'spin a wheel to win a prize'), it actually looked pretty decent presentationally and not like those old school virus popups where you knew something was off due to their jarring ugliness and typos.

I quickly clicked past it but if I stopped to think about it, I would have concluded likely scam. Sadly there's sites like Duolingo that ride the dopamine train with silly stuff like this so it wasn't far fetched. Users be like oh boy yet another site wanting me to click a million times for something.

Guess if I see again I'll screenshot. Happy hunting guys! And keep up the good work.

Thank you for the update!

It happened to me yesterday on mobile, so I'm glad it wasn't a fluke on my side. I quickly uninstalled and reinstalled the Android app.

I was unable to find a security email to send this to anywhere on your site so I posted the technical details in my bug reports. Would really have preferred a security email for posting in those details so that the hackers wouldn’t have the heads up.

Can we please get more info, including if this was related to failing to fix the PHP exploit?

This is very scary o.O
Hopefully it only resulted in an annoying popup, let's hope no backdoor's been installed!