Neopets Website Hacked!!

[Blue]

No password reset emails for me, either. I have tried repeatedly. I did verify the email address a week or two ago, so I am fairly certain my "Neopets Only" email is correct. I received an email from Neopets on 7/20/2022 talking about going to Comic Con, so that email appears to be correct and it is not going to spam. Ugh.

I created a ticket. We shall see.

I also sent a password reset request for my recent side account.

Maybe this is a good time to see if I can get into my original side account since the ticket form has an "original email" field.

ETA: For what it's worth, I received an immediate (automated) response to my ticket...

ETA2: I just received the official Neopets email update on the hack, but no password reset email.

[Pickles]

ETA: For what it's worth, I received an immediate (automated) response to my ticket...

ETA2: I just received the official Neopets email update on the hack, but no password reset email.

This. Both of these. No password reset emails, but the official update email came through just fine. Not gonna lie, it smarted when it showed up. I think the email service I use determines that some emails are "spam" and automatically rejects them the moment they hit the server. I think it has to do with whether or not an email can be replied to or not? Tickets come from support@neopets.zendesk.com, newsletters from community@neopets.com, and password resets from neopets@neopets.com. I don't know. Unfortunately, the service provider for that email does not have any sort of live chat or phone number I can call for assistance, so...yeah.

At any rate, I have a new email set up with a different service, ready to go as soon as I can get back into my account and fix things.

I have no idea if they're working through reset tickets yet or not. Supposedly there are over 3,000 tickets that have been created since yesterday. Could be a while before either of us hear anything, Blue. I've gotten help with tickets at up to almost 6pm NST before, so I haven't given up hope for today (but probably should).

---------------------------------------------------------

On a totally different note (but quite likely related), flash games stopped working this afternoon. I strongly suspect that the "security issue" that allowed the hacker to get in had to do with the flash games, and that we've now seen the end of them. Which means we're stuck with the games that don't work properly and don't have high score lists. Joy.


ETA: Flash has stopped working because Neo forced all pages to https (which flash does not work with). I would say it's the end of all flash content on the site.

I have not heard back from Neo support, but a few people have, claiming that they've been told that they should've received an email with the reset link (they have not, obviously).

So...I jumped through lots of hoops in the last 18 hours to get to the right people through my email service provider (trust me, this was no piece of cake). Once I found a number I could actually call, I spent 2 hours on the phone with support last night (the right people to assist were not in the office when I finally got to the right person), and another hour today, attempting to find out why the email is not being delivered. Long story short, they eventually determined that they couldn't fix it and provided me with an email address to submit a ticket to higher-level support. Despite being assured on the phone that they have no ability to block emails (I was pretty sure this was what they're required to say until proven otherwise, as I did), the automated email that came back stated that they don't intend on blocking legit email, but it can happen.

So...with any luck, either Neo will get back to me with actual assistance getting back in and I can change my email...or my email provider will get back to me with information that they have unblocked the sender. Here's hoping?

[Blue]

Here's hoping indeed. I have yet to receive a reset email or a response to my ticket.

[Siniri]

Good luck to both of you.

I heard that TNT has set up an alternative reset method for those who can't access the email. That's all I know, unfortunately, but maybe you guys can get back in without the email?

[Blue]

Good luck to both of you.

I heard that TNT has set up an alternative reset method for those who can't access the email. That's all I know, unfortunately, but maybe you guys can get back in without the email?

Thanks Siniri. Hopefully the alternative reset will work. Definitely not getting the emails. Also no response to my ticket, unless that email is not coming through either.

[Pickles]

I've heard of people getting back into their accounts via tickets now, too. Hoping it'll be sooner than later, but I'm not expecting it before the weekend at this point. I think I was too far down the ticket list, even submitting on the first day. I've still heard nothing from either Neo or my email provider. Wasn't really expecting anything from either yet, though, so...there's that? Bleh.

On the flash games front:

Flash game problems may stem from us finally forcing https protocol on main pages today as part of our further attempts to make Neopets a safer place. I believe the core issue is flash game/preloader code makes callbacks to /crossdomain.xml on our site using http instead of https which fails when redirected. Will make sure this gets brought to TNT for discussion

So....we MIGHT see them come back? Maybe? I'm not holding me breath on that, either, though.

[Blue]

Just because I apparently have more time to kill on Neo by not doing anything, I set up a new account to see if the activation email would come through... No activation email came through to my inbox. Cannot say that I am surprised.

[Siniri]

I managed to get your NF request, though, Blue!

[Blue]

With my new side account, I first tried using my primary email address. No dice on the activation email. I then changed my email on that account to gmail and the change email confirmation email came through immediately.... Hmm. I should confirm with the reset email on that side account now.


ETA: Yep. Confirmed. gmail works well for the password reset email.

[Siniri]

Another friend got in temporarily. Have your alternate email ready, and if you're able to log in for a bit, immediately change your email, so if you get kicked out again (the friend did after an hour), you'll at least be able to receive the email to unlock it again.

[Blue]

I just tried to get in with my "old" password, but no dice. Still not getting the PW Reset emails for my primary account.

[Pickles]

I've heard a big fat nothing from my email provider or Neo, still.

Sounds like they are not going in order of ticket numbers in terms of letting people back in. Someone with a ticket number much higher than mine (I've got a 315XXX, they were a 316XXX) got back in today. I'm hoping I didn't get passed up or something. Sigh. I'm still trying to not worry about it yet. Just...disappointed that they're not going in order.

[Blue]

Ditto.

For what its worth, my ticket number is 317XXX. *sigh*

[Pickles]

OMW!!!!!!! I'm back in!!!!!!!!!
Alice is answering tickets over the weekend!!!!!!!!!!!!!!!!!!

I was seriously not expecting anything until Monday at earliest. Honestly, I'm still a bit in shock that it happened today!

First thing I did after I got back in was change my password (per the instructions she gave with the temporary password she provided). Second thing I did was go through the change email process. It says it updated, but still shows my other email address. I will be checking back on this to make sure it updates properly.

I have 12 neomails from various dates and times informing me that the emails bounced. I guess that's how many times I attempted (off and on) to see if it would go through?

E-mail message has bounced!
Message:
A message sent to you at xxxx@xxxx was not delivered. The message from the other server is 'This email address has bounced in the past'. Check //www.neopets.com/faq.phtml to find out what you can do to fix the problem.

At any rate, I'm hoping it will update with my new email address so if they force this in the future, I don't have any other trouble.

I will update if I get kicked back out, etc, and how it goes from here.

Still!!! I'm BACK!!!!

I hope you get access again soon, too, Blue!!

ETA: Email updated, just took about 10 minutes or so to do so. I will hopefully not get locked out again, now!

[Siniri]

Woohoo, Pickles! I was so excited to see that NM from you. (I'm in the middle of a solitaire game, so I haven't read it yet, but I ran over here to see what you had to say here.)