An Additional 140,000 User Accounts Were Exposed in Nintendo's April Data Breach

In the aftermath of a data breach, companies need to determine how many users were affected and disclose the attackers' modus operandi. That way, people will have a clear understanding of the scale of the breach and the hackers' level of sophistication. It seems like a straightforward job, especially for large, multi-national organizations, but as Nintendo users can testify, it sometimes turns out to be a lot harder than it appears at first.

Nintendo's breach was bigger than initially anticipated

It all began in early-April when a large number of users complained that they can't log into their Nintendo accounts. Some even noticed unknown charges to the payment method saved in their profile, but despite all the complaints, initially, the video game company said nothing. As BitDefender noted at the time, Nintendo's Japanese support account on Twitter did eventually admit that something might be wrong, but the official announcement was postponed by a couple of weeks.

On April 24, a data breach notification appeared on Nintendo Japan's support page, saying that there's been an attack against the Nintendo Network ID (NNID) accounts of 160 thousand users. Through the NNID accounts, the hackers gained access to the users' nicknames, dates of birth, email addresses, and countries of residence. They also used the NNID accounts to log into the main Nintendo profiles, where the owners' names were also available.

Nintendo was quick to point out that the cybercriminals didn't get access to any credit card details, but they did point out that some unauthorized purchases were made inside Nintendo's official shop using payment methods saved in compromised accounts.

Shortly after announcing the breach, Nintendo separated the NNID accounts from the main Nintendo profiles, reset affected users' passwords, and started refunding the unauthorized transactions.

Unfortunately, this wasn't the end. The complaints continued, and after an investigation, Nintendo concluded that a further 140 thousand accounts may have been affected, bringing the total figure to a nice, round 300 thousand.

Nintendo's disclosure is less than perfect

People shouldn't be upset about the revision of the figure. Investigating a data breach is no easy task, and sometimes, the whole picture doesn't become clear until weeks or even months later. When it comes to detailed disclosure, however, things should be as clear as possible from the very start, and in the case of Nintendo, this isn't what we're seeing.

For one, although the breach has affected people from all over the world, the notification isn't available on all of Nintendo's global websites. The US support page, for example, makes no mention of it whatsoever, and although the UK branch does acknowledge the incident, the technical details are missing.

Most people who want to learn more about the breach need to use an automatic translation service and try to figure out what Nintendo meant, which could be even harder than it sounds. The notification makes it clear, for example, that although the hackers used valid usernames and passwords to log into people's accounts, Nintendo's systems were not compromised in any way. We don't know, however, whether the crooks phished them directly from the users or whether they took them from a database breached during an unrelated incident and used them for a credential stuffing attack.

Nintendo's security experts may have realized how many people were affected by April's data breach, but they clearly have more details to uncover and disclose. Let's hope they'll do it quickly and transparently.