Important: your Supercell forum password may be at risk – change it immed

Printable View

January 17th, 2017
LetTheMusicPlay

Important: your Supercell forum password may be at risk – change it immed

From Nick[Supercell] in Announcements:

Quote:

Dear Supercell Forum user,

As we've said before, to provide our forum service we use software from vbulletin.com. We're currently looking into report that a vulnerability allowed third party hackers to gain illegal access to some forum user information, including a number of emails and encrypted passwords. Our preliminary investigation suggests that the breach happened in September 2016 and it has since been fixed.

We take any such breaches very seriously and we follow very strict policies when it comes to security. Please note that this breach only affects our Forum service. Game accounts have not been affected.

To make sure your account is not being accessed without your knowledge, please change the password you are using on this forum as soon as possible. You can reset your password here: https://forum.supercell.com/login.php?do=lostpw

We also strongly advise you to change the password in any other systems you are using with the same login. As a general guideline, matching credentials should not be used on multiple sites.

We apologise for the inconvenience this has caused.

Best Regards,
Supercell Community Forums

Sorry for the copy/paste of Nick's closed thread, but I have a question, and it's kind of important.

Nick provides a link for changing passwords that requires a reset via our registered email.

I know someone who's having trouble accessing the email she used for the forums. Will changing her forum password through her Settings work (in terms of securing forum access)?

https://forum.supercell.com/profile.php?do=editpassword

Thank you.
January 17th, 2017
Nick[Supercell]

Quote:

Originally Posted by LetTheMusicPlay

From Nick[Supercell] in Announcements:

Sorry for the copy/paste of Nick's closed thread, but I have a question, and it's kind of important.

Nick provides a link for changing passwords that requires a reset via our registered email.

I know someone who's having trouble accessing the email she used for the forums. Will changing her forum password through her Settings work (in terms of securing forum access)?

https://forum.supercell.com/profile.php?do=editpassword

Thank you.

Then ask that person to go here: https://forum.supercell.com/profile.php?do=editpassword to change the email address to a one which works. :) Note - to change the email address OR password on that page requires that your friend knows his/her current password.

Cheers,

Nick
January 17th, 2017
TheGneissRock

Quote:

Originally Posted by LetTheMusicPlay

From Nick[Supercell] in Announcements:

Sorry for the copy/paste of Nick's closed thread, but I have a question, and it's kind of important.

Nick provides a link for changing passwords that requires a reset via our registered email.

I know someone who's having trouble accessing the email she used for the forums. Will changing her forum password through her Settings work (in terms of securing forum access)?

https://forum.supercell.com/profile.php?do=editpassword

Thank you.

Apart from what Nick suggested about changing emails, I did it directly from Settings, and didn't need to log in to my email at all.
January 17th, 2017
Nick[Supercell]

Quote:

Originally Posted by kartikeya2010

Apart from what Nick suggested about changing emails, I did it directly from Settings, and didn't need to log in to my email at all.

Sure you can change it from the settings, but it is still recommended to update the email address to a working one as well. :)

Cheers,

Nick
January 17th, 2017
LetTheMusicPlay

Thank you, Nick and Kartik. :)

Will do as you advise.
January 17th, 2017
ClashOfHolmes

Quote:

Originally Posted by Nick[Supercell]

Sure you can change it from the settings, but it is still recommended to update the email address to a working one as well. :)

Cheers,

Nick

Nick, is my account at risk? I signed up the 5th of october please help
January 17th, 2017
Nick[Supercell]

Quote:

Originally Posted by ClashOfHolmes

Nick, is my account at risk? I signed up the 5th of october please help

Just change your password as instructed and you're safe. :)

Cheers,

Nick
January 17th, 2017
ClashOfHolmes

Quote:

Originally Posted by Nick[Supercell]

Just change your password as instructed and you're safe. :)

Cheers,

Nick

Can I PM you for tell you my password and tell you the new?
January 17th, 2017
Nick[Supercell]

Quote:

Originally Posted by ClashOfHolmes

Can I PM you for tell you my password and tell you the new?

Don't ever give ANYONE your password, not even staff members. Just go here: https://forum.supercell.com/profile.php?do=editpassword and enter your old and then new one + save changes. It is super simple and easy.

Cheers,

Nick
January 17th, 2017
ClashOfHolmes

Quote:

Originally Posted by Nick[Supercell]

Don't ever give ANYONE your password, not even staff members. Just go here: https://forum.supercell.com/profile.php?do=editpassword and enter your old and then new one + save changes. It is super simple and easy.

Cheers,

Nick

Done, thanks! Sorry, I just wanted to ask you if my current password is secure... thank you! :heart:
January 17th, 2017
BostonGirl

Thank you LTMP for reposting. I had not seen this and it was unlikely that I would. The brief time I have on this forum I spend in "General"...generally.:smirk:

Nick, for this kind of security issue, a banner at the top of every page for a week may be more effective or, even better, an in-game announcement. This is just a suggestion.
January 17th, 2017
Nick[Supercell]

Quote:

Originally Posted by BostonGirl

Nick, for this kind of security issue, a banner at the top of every page for a week may be more effective or, even better, an in-game announcement. This is just a suggestion.

The announcement feature (banners on each page) on vBulletin has proven to have many exploits and thus it has been disabled for many years. An in-game announcement would have been a bit overkill and since this applies to the forums only, the most applicable place to announce it was/is on the forums. All registered users affected should have gotten an email about this anyway.

Cheers,

Nick
January 17th, 2017
BostonGirl

Okay re the banners. I also take the point on the in-game announcement - kind of. I realise that part of the consideration would be PR. No company wants to have to announce a security breach.

Would a force-page solution work better? In addition to the "Announcement", anyone coming to the forum for a week (for example) would be taken first to a page explaining the breach and allowed the opportunity to change the password.

I'm not trying to be difficult so I hope you take my posts in the spirit I intend. I really had not seen the notice until LTMP's post and I had come to forum three times for the day, albeit briefly.
January 17th, 2017
meemeeme

Hi, I got this e-mail before one hour and I am finaly here after I was unable login to forum more than one year. I thougt that I loose my account...
January 17th, 2017
Nick[Supercell]

Quote:

Originally Posted by BostonGirl

Okay re the banners. I also take the point on the in-game announcement - kind of. I realise that part of the consideration would be PR. No company wants to have to announce a security breach.

We are very transparent in these cases, but no need to alarm all players out of which only a handful are affected. Like I said, emails were sent to all affected which is sufficient (in addition to the announcements on multiple forums).

Quote:

Originally Posted by BostonGirl

Would a force-page solution work better? In addition to the "Announcement", anyone coming to the forum for a week (for example) would be taken first to a page explaining the breach and allowed the opportunity to change the password.

Unfortunately the forums don't have such a feature, tho the idea is good. We are limited to what the forums offer.

Quote:

Originally Posted by BostonGirl

I'm not trying to be difficult so I hope you take my posts in the spirit I intend. I really had not seen the notice until LTMP's post and I had come to forum three times for the day, albeit briefly.

It is always recommended to check the announcements every now and then. :) We try to keep our community in-the-know by posting announcements when there's a need for it.

Cheers,

Nick
January 17th, 2017
ClashOfHolmes

But how do hackers gain access here? Rauta in some message said that this is a super sure forum...
January 17th, 2017
buggles

Quote:

Originally Posted by Nick[Supercell]

Then ask that person to go here: https://forum.supercell.com/profile.php?do=editpassword to change the email address to a one which works. :) Note - to change the email address OR password on that page requires that your friend knows his/her current password.

Cheers,

Nick

Ok, Nick. I went to link and I get nothing in order to change my forum Pass Word, now what ?
January 17th, 2017
Nick[Supercell]

Quote:

Originally Posted by ClashOfHolmes

But how do hackers gain access here? Rauta in some message said that this is a super sure forum...

As you may understand, I can't go into details how it is done or was done (security reasons). That being said, we are always doing our best to keep our forums safe but since the service (forums) is provided by a 3rd party company, we can only update the forums when an update is available.

Cheers,

Nick
January 17th, 2017
ClashOfHolmes

Quote:

Originally Posted by buggles

Ok, Nick. I went to link and I get nothing in order to change my forum Pass Word, now what ?

1st: Insert your current password in the first text box
2nd: Insert your new password in the second and then re-write it in the 3rd
3rd: Click on 'Save Changes'

Well, now your password is changed! Try logging out and then logging in.
January 17th, 2017
Nick[Supercell]

Quote:

Originally Posted by buggles

Ok, Nick. I went to link and I get nothing in order to change my forum Pass Word, now what ?

That's odd. If you are logged in, you should see one input field to enter your current password, and then 2 input fields to input your new password. If you have trouble doing this on mobile, try desktop view (full site link from the footer of the page).

Cheers,

Nick
January 17th, 2017
meemeeme

As I said I got this e-mail, but why you used amazonses.com domain and not Supercell.com? This is strange and I am afraid what will be hapened after I log out from forum??
January 17th, 2017
Nick[Supercell]

Quote:

Originally Posted by meemeeme

As I said I got this e-mail, but why you used amazonses.com domain and not Supercell.com? This is strange and I am afraid what will be hapened after I log out from forum??

The email you got is trustworthy. If you don't anyway trust it, use this link to change your password: https://forum.supercell.com/profile.php?do=editpassword

Cheers,

Nick
January 17th, 2017
meemeeme

Ok, now I will log out and try again login. If you not see me soon it mean I cant login...again :(

Yes, I am still here :)
January 18th, 2017
buggles

Ok, Im not getting 2 places with password .....now what?
January 18th, 2017
buggles

Ok, I hope this worked....wait...I cant access my settings again I keep getting told it can't be access through my system?
January 18th, 2017
Nick[Supercell]

Quote:

Originally Posted by buggles

Ok, I hope this worked....wait...I cant access my settings again I keep getting told it can't be access through my system?

Are you using mobile or desktop? If former, tap on the link in the footer which says "full site" and then copy & paste this link to the address bar: https://forum.supercell.com/profile.php?do=editpassword

You should end up on a page where you can enter your current password, new password and change your email.

Cheers,

Nick
January 18th, 2017
Raelet

Done! The forums logged me out when I changed my password. Took me a while to figure it out. Doh!!
January 18th, 2017
AnOwningChicken

How can I delete my account? Yes this is due to the breach and no I couldn't find and answer anywhere else.
January 18th, 2017
LynnK2015

Quote:

Originally Posted by AnOwningChicken

How can I delete my account? Yes this is due to the breach and no I couldn't find and answer anywhere else.

Just to be clear, your forum account and not your Hay Day account was breached?

I don't know how one can delete a forum account. Maybe the Mods or the GASPs may help you by referring to the Forum Admin? Good luck.
January 30th, 2017
buggles

Quote:

Originally Posted by Nick[Supercell]

As you may understand, I can't go into details how it is done or was done (security reasons). That being said, we are always doing our best to keep our forums safe but since the service (forums) is provided by a 3rd party

company, we can only update the forums when an update is available.

Cheers,

Nick

Nick,
I can't change my password again after I was requested by SC to change it because apparently my recent password change is no longer good? I tried to change it and your system keeps saying my mobile device is not supported Im on the same tablet Ive always been on (Android) why can I not access change password on my profile page instead of dancing with links that produce nothing...annoying.

please fix this or better explain how to access my forum account to change password..

Thanks
January 30th, 2017
Sjowhan

Quote:

Originally Posted by buggles

Nick,
I can't change my password again after I was requested by SC to change it because apparently my recent password change is no longer good? I tried to change it and your system keeps saying my mobile device is not supported Im on the same tablet Ive always been on (Android) why can I not access change password on my profile page instead of dancing with links that produce nothing...annoying.

please fix this or better explain how to access my forum account to change password..

Thanks

have you tried to display the website as a desktop site?
It's possible the mobile version of the forums don't support changing password..