Hacked account advice

[Ñightsham]

Sorry for the long post.......................

My account(s) were recently hijacked and I was hoping to get some advice from the group here on what can be done in order to get some (if any) of my items back & of course the gold in my acct.

I have 6 accounts associated with the so called "new and improved" Battle.Net accounting system. I have no idea how the account was compromised. I have never shared these accounts with anyone.
I recently did a new install of Win7 Pro along with a AV program a few weeks back, but other than that nothing out of the ordinary.

@ 1:10am (email timestamp)
I rec'd an email stating "Your password has recently been modified through the Account Management website"
=====
@ 4:20am
Account Name: XXXXXXX

Account Action: 3 hour suspension and password reset
Reason for Action: In-Game Chat Policy Violation - Advertisement and Spamming
======
@ 4:22am
Battle.net Account - Password Reset

We have reset the password for the Battle.net account associated with this email address. To choose a new password, please click the following link and follow the instructions:
=====

I immediately sent an email to Blizzard explaining what had happened, then I had to wait a few more hours for the accounting department to open up so I could follow-up with a phone call.
After waiting literally 55 minutes on hold, I spoke to a acct rep.

The Good news..... I got back control of my account(s) (The hackers had even placed a Blizzard Authenticator on there!)
Most of my toons were still there, although a few were deleted on my main account.

The Bad news: A few toons on my main account were deleted, Guild bank was stripped of all valuabe items, ALL the guild's gold was gone, ALL remaining toons were stripped of thier gear/bank items/bags & gold

As noted, most of the damage was done on my main account, and in the short time frame this happened they managed to create (25) Level 1 toons across (13) different US servers & (12) Oceanic servers.



Since I've already done the obvious
1) Is there any hope of getting some of my gear/items back?
2) Must I create an in-game ticket for each and every toon that was affected?


I'd appreciate any insight any of you may have here regarding this issue.



Thanks

[Whowantstoknow]

1) Yes: create an in game ticket
2) No: usually one per account is enough

[nissen]

If you havent shared your account , you either got hacked by a man in the middle while reading forums or you got a keylogger on one of the machines which you either read forums on or on you wow computers. i would advice you to get a authenticator , even tough a keylogger snatches your password and code it will only be available for them in 30 secs.

[Babysir]

This is why its very important to have an authenticator already on your account. Sure it can be an annoyance at times, but the added security outweigh the any annoyance. Even if you have 5 seperate battlenet accounts you can use the same authenticator on all 5.

[Ñightsham]

If you havent shared your account , you either got hacked by a man in the middle while reading forums or you got a keylogger on one of the machines which you either read forums on or on you wow computers. i would advice you to get a authenticator , even tough a keylogger snatches your password and code it will only be available for them in 30 secs.

I'm very pro-active on security and as an ironic twist to this I had recently reported 2 different in-game messages sent to me about "so-called" get your xmas free mount or whatever, that I had sent those sites to blizzard reporting the offending website. The thing is, I didn't access that site on my WoW computer (I only play/MB from 1 computer) I accessed it from a seperate computer and the only commonality is that they are on the same LAN.

I agree with you totally, keylogger or a middleman, though the latter seems remote. I'll do a full scan again when I can, in the meantime I'll play from the Macbook

[Ñightsham]

This is why its very important to have an authenticator already on your account. Sure it can be an annoyance at times, but the added security outweigh the any annoyance. Even if you have 5 seperate battlenet accounts you can use the same authenticator on all 5.

Agreed!
I'll b getting that asap.

[JackBurton]

can someone define or elaborate on this "Man in the middle" method of hacking? I just recently got hacked as well. The box i play with has nothing but wow, and vent on it. I only use the web to download addons and do research for the game.

[Ñightsham]

can someone define or elaborate on this "Man in the middle" method of hacking? I just recently got hacked as well. The box i play with has nothing but wow, and vent on it. I only use the web to download addons and do research for the game.

Without getting too in-depth, the middle man refers to intercepting traffic/communication between the source (server) and destination (client, your PC). This basically has to do with unencrypted internet traffic (http://) as opposed to encrypted traffic (https://)

It CAN happen via an exploited Router (BGP attack) for example.

In my case I lean toward the kelogger issue, I'm just not sure it was transmitted across my LAN at home. I'll investigate it further.

[thinus]

The thing is, I didn't access that site on my WoW computer (I only play/MB from 1 computer) I accessed it from a seperate computer and the only commonality is that they are on the same LAN.

They got into your email account and reset the password of your account via the Blizzard lost password tool. This means your email account was compromised, not your Battle Net account. Where and how you log into WoW is irrelevant, it is how and where you log into your email account.

[MageMe]

They got into your email account and reset the password of your account via the Blizzard lost password tool. This means your email account was compromised, not your Battle Net account. Where and how you log into WoW is irrelevant, it is how and where you log into your email account.

Agreed, that is why I do not use my reg email for wow..I use one that is not connected to my reg email in any way shape or form, (friends, sites that require an email to register etc)and I use my wow email for wow only. This way if I desire to register to a site, then my wow email is not compromised.