Warframe

In November 2014, the online game Warframe, developed by Digital Extremes, was breached through a vulnerability in the Drupal content management system that powered its website. According to our investigation team, the incident is estimated to have occurred on November 24, 2014, and the listing indexes roughly 103,000 rows of data. The breach went unconfirmed for years until the studio publicly acknowledged it in July 2016.

Breach Timeline

November 2014: Attackers exploited a Drupal SQL vulnerability on Warframe's website and obtained email address data. The studio initially believed the reports were a phishing scam because its account server appeared secure.

July 25, 2016: Digital Extremes confirmed the breach in a Warframe forum post, stating that 775,749 email addresses had been acquired through the Drupal SQL exploit, which the Drupal project patched two weeks after the attack occurred.

What Information Was Compromised?

Our analysis found the following data types in this breach: email addresses and usernames.

According to the company's forum notice, the stolen data did not include account passwords, variations of passwords, hashed passwords, game account data, or personal player information such as full names, addresses, or billing and payment details. The notice also stated that while hashes appeared in the stolen data, these were described as meaningless hashes of alias names rather than password hashes. Independent trackers such as Mozilla Monitor and XposedOrNot list email addresses and usernames as the compromised data types.

Not every individual is affected by every type of data listed here.

What Are the Potential Risks for Affected Individuals?

Because the confirmed data set is limited mainly to email addresses and usernames, the direct risks are lower than in breaches involving passwords or payment data. Even so, exposed email addresses can be used for targeted phishing emails that impersonate Warframe or Digital Extremes, potentially tricking recipients into revealing login credentials or other personal information. Attackers can also cross-reference these addresses against other leaked databases to build profiles on individuals.

The studio itself noted at the time that a wave of account compromise reports followed the breach, although it did not confirm a direct link between those reports and the stolen email list. Anyone who reused their Warframe email address and password across multiple sites should remain cautious.

What Is Warframe Doing in Response?

In its July 2016 forum post, Digital Extremes said it had implemented two-factor authentication and moved away from Drupal to a custom website system that no longer retains account information, steps intended to reduce the risk of a similar attack. The studio also warned players that it would never ask for a password by email and that Warframe.com is the only site where players should enter their login details.

In 2022, after a claim surfaced that millions of Warframe user records had been newly leaked on a cybercrime forum, community director Megan Everett stated on the Warframe forums that the claim was "repackaged information" from the 2014 breach and was being presented as new, according to PCGamesN. The studio said a fresh investigation found no repeat of the original incident.

What Should You Do If You Were Affected?

Change your Warframe password if you have not done so since 2014, and enable two-factor authentication where available.

If you reused that password on other sites, change it everywhere.

Be wary of unsolicited emails referencing Warframe, especially any asking you to log in, verify your account, or provide payment details.

Consider using unique passwords for every account and an email mask when signing up for new services.