In late June, a small number of (mostly inactive) accounts were broken into and stripped of everything they owned.

Every one of these break-ins happened the same way, through the lost-password flow. If there's one thing to take from this, it's to change your email password and use one you don't use anywhere else, because a compromised inbox is keys to all of your digital accounts.

Once they were in, they emptied the account. They listed everything in the account's own shop for a single point and bought it through throwaway alts, then moved on to the next account. We caught it, froze the accounts doing the buying after an investigation (and ensuring they didn't have access to any more accounts), and reset the passwords on the accounts that were broken into so they couldn't be touched again.

Then we went back through the shop logs and rebuilt, item by item, exactly what left each account. Everyone who was hit is getting a fresh copy of everything that was taken. Stolen gift cards come back as Cash Shop Credits rather than new cards, credited straight to the account. You can see your own list on the returned items page.

One honest note about custom wearables. Most of the stolen items had already been resold, at fair prices, to players who had no idea they were buying stolen goods. There were thousands of those sales, and unwinding them would only turn thousands of innocent buyers into new victims. So we left those purchases alone and gave the original owners fresh copies instead. That does mean a handful of custom wearables now exist in slightly larger numbers than they did before. Returning people's items is worth that to us, and I would make the same call again.

If you were affected and something still looks missing after all this, open a ticket and we'll help as soon as we can.