Game publisher Riot Games, famous for competitive online titles such as League of Legends and Valorant, was recently the victim of a security breach that targeted code that governs game cheats. Given the status of these games in the billion-dollar eSports market, that code is actually worth a substantial amount of money.
The hackers did not appear to be after payment data or personal information, both of which Riot says remains secure. The big prize was instead the source code for some of Riot’s anti-cheat software, used to ensure fair competition in online contests that often have big money riding on them.
“Amateur level” security breach may have involved social engineering
The hackers, who remain unidentified, were disparaging of their own work (and by extension Riot’s security posture) in a Telegram channel set up to negotiate a payment. Riot would only say that a social engineering incident in the development environment was what opened the door to the stolen game cheats. The hackers used names of Riot employees as handles in the Telegram channel, but it remains unclear if they were compromised or had some involvement in the issue.
The security system in question, called Packman, ensures that players of League of Legends and several other Riot titles cannot cheat in the online contests. The hackers demanded 10 million dollars for its safe return, but Riot appears to have refused to pay. In addition to the game cheats, the hackers appear to have also filched the source code for League of Legends itself, which they are now attempting to auction at a starting price of $1 million. They are also auctioning the Packman code for half a million dollars.
Riot appears to feel the security of League of Legends remains sound for now, but the loss of source code always raises serious questions about what vulnerabilities may be found. In this case, game cheats that can be used to disrupt online play and tilt official matches is probably a greater concern than the possibility of players being hacked, though it is possible exploits could be leveraged for in-game phishing campaigns.
The security breach follows something of a rise in the targeting of online games, specifically for source code that can be sold on the black market. In the past two years the same thing has happened to major game publishers such as CD Projekt Red and Rockstar Games.
Game cheats for Teamfight Tactics also stolen; status of Valorant unclear
The game cheat code that was stolen reportedly protects League of Legends and Teamfight Tactics, but Riot says that Valorant is protected by a different system. The hackers claimed they had access to Valorant in at least one post, however.
In terms of immediate impact of the security breach, Riot paused planned content updates temporarily but otherwise gameplay has appeared to continue as normal. The company’s internal investigation remains ongoing. Riot has said that each impacted game will issue updates on the matter through its own official channels.
