Hey,

I was suggested to get an admin to run IP's logging into my account.  I was playing earlier today, and was playing as normal.  But when I logged on this evening I noticed that I was missing a lot of gear from my account.  Although I only started yesterday a fellow player gave me some items to help me start (shout out to them). 

I had been fishing in Seers after working on some Herblaw in Tavlery.  I used one of my Charged Dragstone Ammy's to go to seers and landed near the portal.  I fished my way to 40ish.  Then logged off for a little bit.  When I logged back on I spawned near the Seers Portal again, which I thought odd but nothing more than that.  I went straight back into lobster fishing.  After 2 runs of fishing and cooking I noticed I was missing my most valuable items from my bank. 

Mod Nova started to help me, but I wanted to make sure I posted this for other people who may be having the same problem.

P.S. No, I've not gotten bots, or 3rd party soft.  I don't have friends that play, and I didn't give out my password.

I'm a noob, but I lost:

1 Rune Large Helmet
1 Rune Legs
1 Rune 2-handed sword
2 Adamant Chest Plates
23 unfinished potions (prayer)
2 Charged Dragonstone Amulets
5 Ruby Amulets of Strength
5 Diamond Amulets of Power
Approximately 18,000 coins

Help and Happy Gaming
Buck007

Hey there,

I have come to learn that your account was indeed compromised. The culprit has been dealt with, and to my knowledge, you have been somewhat reimbursed.

Please send me a private message when you're on next and I can give the items I've traced back to you. Please also ensure your account is secured by changing your password (forum and in-game), to something more secure.

Thanks,
Pyru

How did the account get compromised?

There is no way to get compromised, unless he downloaded a keylogger bot, or he shared accounts. In which both cases he should never have got his items back.

Or, you know, the Leg-acy database getting leaked (since a few untrustworthy people have their hands on it now). Someone could recognize a name in their database, crack a hashed password and if they used the same one here, use it to log in.

Regards,
Pyru

There is no way to get compromised, unless he downloaded a keylogger bot, or he shared accounts. In which both cases he should never have got his items back.

Or, you know, the Leg-acy database getting leaked (since a few untrustworthy people have their hands on it now). Someone could recognize a name in their database, crack a hashed password and if they used the same one here, use it to log in.

Regards,
Pyru

haha typical people leaking databases. Nonetheless, may want to post a warning to everyone that used the same password.

It will be posted tonight, along with some other important announcements.

Maybe it should be posted earlier if it got leaked no?

Lol don't be foolish. It's not like the admins have acknowledged they are bad at communicating with the community and promised to do better or anything. Also it's not like people getting hacked matters best to wait a few days for maximum damage to the community they care for so much.

All it takes is 1 simple database change to change everyone's password and make them email reset it.

Thanks for the heads up, please sticky this thread @administrators @moderators, so that people are more aware of the potential threats they could endure from using the same password on multiple servers. There is ALWAYS a risk of being hacked (Whether it be from a database leak, or from other server owners having administrative rights to search the 'players' name in the mySql database -- from there they can decode the md5 -- or other cryptographic -- hash(s) and hack you).

All it takes is 1 simple database change to change everyone's password and make them email reset it.

Thank you for telling us this oh great walden.... lmao