Epic Games Hit With Class Action Lawsuit Over Hacked ‘Fortnite’ Accounts

The lawsuit, filed by ‘Franklin D. Azar and Associates’ in the
United States District Court in North Carolina on behalf of over
100 affected users, claims that “affected Fortnite users have
suffered an ascertainable loss in that they have had fraudulent
charges made to their credit or debit cards.”

According to the lawsuit, Epic Games acknowledged a
vulnerability in its system that allowed hackers to unauthorizedly
access players’ account and purchase in-game currency using their
saved credit or debit cards.

Apparently, the law firm is trying to connect two separate
reports—first, a responsible vulnerability
disclosure in Fortnite system and second, multiple password
reuse and phishing attacks—alleging that the vulnerability which
CheckPoint reported earlier this year was exploited in the wild.

However, at that time, neither security firm CheckPoint nor
Fortnite developer Epic Games acknowledged or claimed that the
reported vulnerabilities had actually been exploited to takeover
Fortnite player accounts.

Instead, Epic Games released a separate
advisory^[2] on its website warning
its users about phishing and credential stuffing attacks, where
hackers were successfully able to compromise an undisclosed number
of Fortnite accounts using username/password combinations leaked
from third-party sites.

For those unaware, in January 2019, Check Point researchers
disclosed a cross-site scripting (XSS) flaw in Fortnite that could
have allowed remote attackers to completely takeover
player accounts just by tricking them into clicking an
unsusceptible link.
^[3]

The attackers even could have access to all the victim’s in-game
contacts and conversations held by the player and his friends
during the game, which can then be abused to exploit the account
owner’s privacy.

Besides this, the law firm also claimed that
“Check Point notified Epic Games of the vulnerability in November
of 2018. Not until two months later did Epic Games acknowledge the
flaw. Epic Games did not disclose how many accounts were affected
by the data breach.”
^[4]

The Hacker News has reached out to Epic Games, CheckPoint and
Franklin D. Azar & Associates for their comment on this matter, and
we will update the article as soon as we hear back from them.

Even if the reported account takeover vulnerability was not
exploited, the lawsuit could still create problems for Epic Games,
knowing the fact that hackers actively sell stolen Fortnite
accounts on shady internet forums.

According to a report on BBC^[5]
published late last year after interviewing 20 hackers, several
teens, as young as 14, are found making thousands of pounds every
week by selling hacked Fortnite accounts due to the popularity of
the royal battle game that has over 200 million registered
users.

Whatever be the outcome of the latest lawsuit filed against Epic
Games, The Hacker News strongly recommends all users to remain
vigilant while exchanging any information digitally and always
check for the legitimacy of links to information available on the
User Forum and other Fortnite websites.

To protect your accounts from being hijacked, you are also
advised to enable two-factor authentication (2FA) which prompts you
to enter a security code sent to your email upon logging into the
Fortnite game, preventing account takeover even if your account
credentials get compromised.

Most importantly: Using the same password across multiple
websites is a bad, bad idea.

^[1]