DiabloFans

Players and Friends,

Even when you are in the business of fun, not every week ends up being fun. This week, our security team found an unauthorized and illegal access into our internal network here at Blizzard. We quickly took steps to close off this access and began working with law enforcement and security experts to investigate what happened.

At this time, we’ve found no evidence that financial information such as credit cards, billing addresses, or real names were compromised. Our investigation is ongoing, but so far nothing suggests that these pieces of information have been accessed.

Some data was illegally accessed, including a list of email addresses for global Battle.net users, outside of China. For players on North American servers (which generally includes players from North America, Latin America, Australia, New Zealand, and Southeast Asia) the answer to the personal security question, and information relating to Mobile and Dial-In Authenticators were also accessed. Based on what we currently know, this information alone is NOT enough for anyone to gain access to Battle.net accounts.

We also know that cryptographically scrambled versions of Battle.net passwords (not actual passwords) for players on North American servers were taken. We use Secure Remote Password protocol (SRP) to protect these passwords, which is designed to make it extremely difficult to extract the actual password, and also means that each password would have to be deciphered individually. As a precaution, however, we recommend that players on North American servers change their password. Please click this link to change your password. Moreover, if you have used the same or similar passwords for other purposes, you may want to consider changing those passwords as well.

In the coming days, we'll be prompting players on North American servers to change their secret questions and answers through an automated process. Additionally, we'll prompt mobile authenticator users to update their authenticator software. As a reminder, phishing emails will ask you for password or login information. Blizzard Entertainment emails will never ask for your password. We deeply regret the inconvenience to all of you and understand you may have questions. Please find additional information here.

We take the security of your personal information very seriously, and we are truly sorry that this has happened.

Sincerely,
Mike Morhaime

Is there anything that players need to do right now to protect themselves?
While there is currently no evidence that any of the password or player data has been misused, we encourage our North American players to change their passwords. Click here to login and change your password.

In the coming days we will implement an automated process for all users to change their secret questions and answers, as a precautionary measure. We'll also prompt mobile authenticator users to update their authenticator software.

Additionally, while Blizzard has no indication that any of your information was shared with any other unauthorized parties or that there has been any unauthorized use of your data, we urge all members of our community to closely monitor all of their online accounts.

Players should also be wary of fraudulent emails (phishing). Unfortunately, because email addresses were exposed, it is entirely possible that this could result in an increased, targeted phishing campaign being sent to our users. Check this page for tips on how to spot and avoid these types of fraudulent emails. Back to top

What data was affected?
Here's a summary of the data that we know was illegally accessed:
North American-based accounts, including players from Latin America, Australia, New Zealand, and Southeast Asia

• Email addresses
• Answers to secret security questions
• Cryptographically scrambled versions of passwords (not actual passwords)
• Information associated with the Mobile Authenticator
• Information associated with the Dial-in Authenticator
• Information associated with Phone Lock, a security system associated with Taiwan accounts only

Accounts from all global regions outside of China (including Europe and Russia) Back to top

• Email addresses

China-based accounts

• Unaffected

At this time, there’s no evidence that financial information of any kind has been accessed. This includes credit cards, billing addresses, names, or other payment information.

What information related to Mobile and Dial-In Authenticators was exposed? What about Phone Lock?

With regard to Dial-In Authenticators, hashed (not actual) phone numbers were accessed. This is phone data from the relatively small number of people who opted into the program.
With regard to Mobile Authenticators, information was taken that could potentially compromise the integrity of North American Mobile Authenticators. We have no evidence that other regions were affected. We are working quickly to provide software updates to users.
Additionally we believe the integrity of the physical authenticators remains intact.
The information relating to Phone Lock represents a small number of hashed (not actual) phone numbers from Taiwanese players who opted into this service and had a North American Battle.net account.

Was the physical authenticator compromised?
We believe the integrity of the physical authenticators remains intact.

How did this happen?
Like all companies doing business online, it is not an uncommon occurrence to experience outside parties trying to illegitimately gain access to the operation’s structure at some level. We are continually upgrading our security technologies, policies, protocols and procedures to protect our customers and our games against the threats that increasingly arise in today’s online world.

When did Blizzard learn of the unauthorized access?
The trespass into our internal network was detected by us on August 4, 2012.

Why did Blizzard announce this on August 9?
We worked around the clock since we discovered the unauthorized user to determine the nature of the trespass and understand what data was accessed. Our first priority was to re-secure our network, and from there we worked simultaneously on the investigation and on informing our global player base. We wanted to strike a balance between speed and accuracy in our reporting and worked diligently to serve both equally important needs.

What action has Blizzard taken?
Upon learning of the unauthorized access, we worked quickly to re-secure our network. Afterward, we immediately notified law enforcement as well as security experts and launched an ongoing investigation to determine what had occurred. We also took steps to notify players, which happened in a matter of days from the time we discovered the illegal access.

Was any personal or financial information accessed?
At this time, there is no evidence that financial information was affected or accessed. There's also no evidence that personal information such as real names or billing addresses were accessed.

What can you tell us about the scrambled passwords that were accessed?
Cryptographically scrambled versions of passwords for North American players were accessed, protected by Secure Remote Password (SRP) protocol. This information alone doesn't give unauthorized users the actual passwords -- each password would need to be deciphered individually. The added layer of protection from SRP makes that process computationally very difficult and expensive.

Why not immediately invalidate the secret questions and answers that were compromised?
This was a difficult decision to make but in the end we believe that keeping the secret questions and answers in place still provides a layer of security against unauthorized users who don't have access to the compromised data. In the meantime, we are working quickly to create a mechanism for players to change the secret question and answer on their account. Our customer service staff will also know to use additional measures to verify player identities and not rely solely on secret question and answer.

Why not immediately revoke the mobile authenticators?
Similar to the decision surrounding secret question and answer, we still believe that keeping mobile authenticators active provides a layer of security against unauthorized users who don't have access to the compromised data. In fact, the mobile authenticator information by itself won't grant access to a Battle.net account -- that still requires the actual password as well. We are working quickly to deploy new mobile authenticator software and will notify players to update as soon as it's available.

Are you taking additional security measures as a result of this occurrence?
We are continually upgrading our security technologies, policies, protocols and procedures to help protect our customers and our games, and will continue to monitor the situation closely.

Teams have also been working around the clock in an ongoing investigation with law enforcement and security experts, to gain a more detailed understanding of what happened. As we conclude the investigation there will be lessons learned that can help strengthen our security going forward.

Thanks for the feedback! We're looking to bump the number of Preferred Stats slots from 3 up to 6. We're also looking to bump the number of digits in the "Min Value" window from 3 to 5 (so you can search for Preferred Stat values higher than "999").

Are you also fixing it so that you can search for all of the affixes on an item? Some are missing from the list...
We're definitely working on filling the missing gaps. On a somewhat related note, we also want players to be able to search for stats on Legendary items.

While making these changes please give the ability to exclude items with a socket that already have a gem in the socket.
Making it so that stat increases which come from slotted gems aren't taken into account when searching for equipment is absolutely on the "to do" list.

can u guys make it so we can search the DPS on items like offhands, its not an option yet
This is also something we want to do.

Wander what patch this will be implemented in.
Just to be clear, the things I've commented are changes we're working on right now. Some of these changes are planned for 1.0.4, and some are planned for 1.1.0. Due to implementation and testing needs, however, those plans may change and get moved around, so just keep that in mind.

Can you confirm whether you will allow us to see stats on items sold? Or prices we list things at?
You mean stats of items in the Completed tab? If so, yes -- that is functionality we're looking to add. We're also looking to make it so that you can see the listing price of unsold and cancelled items in the Completed tab, as well.
(Not sure if that answered your last question completely, but I still felt it was relevant information to share.)

It would be nice to be able to cancel auctions that have no bid yet. But once they have a bid its locked it, because it will sell.
We like this solution also. We definitely want to provide players with the option to cancel an auction (at any point after it's posted) so long as it does not have any bids. Right now, we're looking at this for 1.0.4, but that of course may change depending on implementation and testing.

Lylirra, is there any looking into giving us the option as to the timers for auctions?
You mean being able to select the duration of the auction? We definitely have seen this feedback (and appreciate it), but we don't have any plans currently.

I do think that the lack of ability to cancel an auction is a bit annoying I do think there are many more improvements that would be more helpful. I put together as short list and I would like to get some other opinions on some more improvements.
Thanks! I'll give it a look. (Blue Tracker / Official Forums)

Older post, but this is relevant:

Changing the text color of gems (as well as potions, crafting pages, and tomes) has been something we've debated doing and not doing for a while now. We've finally come to an agreement, though, and decided to change the ground text color for these items from white to light blue. This is something we looking to implement in a future patch.

(We're also looking to make the gem drop sound much more prominent.)

easy in a program, this kind of a change could be made and tested within 2 days. Why wont it make it for 1.0.4?
Not all of the changes going into 1.0.4 are locked down yet. So, while it's very possible that this change will make 1.0.4 (and that's what we're aiming for), it's also possible that due to testing or implementation or scheduling needs it may not. It's something we want to do -- and would like to do in 1.0.4 if everything works out -- but it may just need to happen at a later point.

We agree that, for newer players (or for players who are new to playing in multiplayer games), it can be confusing the first time you leave a multiplayer game and discover that your hired follower is no longer following you. Most players assume that your follower should automatically rejoin you when returning to a single-player game, and it's not really communicated well in the UI that it doesn’t work that way.

We also agree that having to return to town each time you leave a multiplayer game to re-hire your follower is annoying. We already have plans to change it so that, after leaving a multiplayer game, your last hired follower will be restored automatically for you. It would work this way even if you left a multiplayer game and then logged out; the next time you logged in and picked up your single-player game, your follower would be waiting for you. (Of course, you’d still need to go back to town if you wanted to change followers, same as now.)

Oh, and PS - we're also looking to reduce the frequency of follower dialog. While we don't have any plans at this time to allow players to turn off the dialog completely, we have your heard feedback that you feel followers should be a bit more...terse.

Hopefully the follower will gain some smarts too and stop attacking mobs when I don't want him to.
Haha. They are a pretty excitable bunch, aren't they?
We want to improve follower AI, absolutely -- probably not for 1.0.4, but definitely for the future. This would of course include working to make it so that your followers don't go all LEEEEERRROOOOY JEEEENNNKINS on nearby monsters which you haven't yet attacked (like treasure goblins, Elites, etc).

I still wonder why you say "hire" when you're not paying them or when there is no cost involved when "hiring" them. I know in D2 you had to pay a price to rez your follower, but here there seems to be no tie between gold and your follower.
It's just habit, personally.

Can we get some of that LERRROOOY JENKINS work done on pets, like bats and such? Have had them tag goblins when I'm not ready.
We'd also look at the AI for pets, minions, summons (etc) -- not just followers.

The integrity of Diablo III is incredibly important to us, and we are dedicated to ensuring the game remains a safe and fun environment for everyone. To that end, we’d like to take a moment to let you know that we’re aware of concerns regarding some possible exploits and trading scams being reported by the community, and reassure you that we’re working diligently to keep the game free from exploits, hacks, and other issues that have a negative impact on our players’ experience.

As a reminder, if you have knowledge of a possible exploit, hack, bot, or scam, the best way to inform us is by emailing our hacks team at hacks@blizzard.com or by completing the Hacks Report web form. In your correspondence, please include any steps necessary to replicate the issue, as well as any additional details you’re able to provide. We also ask that you refrain from posting information or instructions on how to use potential exploits on the forums.

We take reports of any potential exploit, hack, bot, or scam very seriously – and while not every reported exploit we look into turns out to be a real concern, we appreciate everyone’s help in keeping us informed of possible issues as they arise. As always, you can keep an eye on the Diablo III hotfix blogs to stay up to date on the latest changes.

We are making some changes shortly that should help with minimizing rubber banding for players here. It would help to have your feedback on the game play experience over this weekend and into next week.
Thanks all

We do are making some changes shortly that should help with minimizing rubber banding for players here. It would help to have your feedback on the game play experience over this weekend and into next week. Thanks all Interesting, hope it works for people Arc, but side note are you drinking on the job =P , that extra 'do' mate ;-)
Only water, what do people put in this stuff?? Thanks for the edit

We want to have a good sample of feedback from the community over the next week to gauge any improvement.
So anytime this weekend through to next week would be of great help.
Thanks all

1.0.4 Release
When is 1.04?
Soon™.
(Sorry, dude. Had to do it. =/) (Blue Tracker / Official Forums)

Blackrock Ledger Page 15
The Black Rock Ledger is a nice little mystery, isn't it? If you're lucky enough to collect all the lost pages, be sure to examine them closely. The devil's always in the details.

source: <link>
Party pooper. (Blue Tracker / Official Forums)

Level 60s
You’ve done well, much better than me. I have one level 60 and I am working on two others right now. Of course, that leaves me with two more which I’m looking forward to. (Blue Tracker / Official Forums)

Zoltun Kulle
Zoltun's story is rather interesting, to say the least. He presented himself as being in support of the human race, but this support was somewhat disingenuous, as he also craved power. Lots of power.

As the story unfolds, he then calls for you to abandon everyone else in order to bring him to ultimate power. Not only would you enslave yourself to him, this would also go against everything you, Tyrael, and Leah have been fighting to restore. (Blue Tracker / Official Forums)

Random
Having a cat on your lap during a meeting is nice, warm, and fuzzy…for the first 15 minutes. After that, my leg started going numb. The cat was more than content to remain as a floppy weight and not move anywhere. Found out I may not be a cat person.

Birds as pets on the other hand; that's an intelligent companion that can be used to invalidate everyone's arguments. (Blue Tracker / Official Forums)