Blizzard Respond to Class Action “False Information”Posted 12 November 2012by
Blizzard has now responded to the action raised by Benjamin Bell, (we reported last week), in which he intends to sue Blizzard for “consumer fraud, unjust enrichment, negligence, breach of contract and bailment” . In addition he charges them with “negligently, deliberately, and/or recklessly fail to ensure that adequate, reasonable procedures safeguard the private information stored on this website. As a result of these acts, the private information of plaintiffs and class members has been compromised and/or stolen since at least 2007″.
According to Blizzard the foundations of his claims are unsound in as much as they are based on “patently false information”.
The suit’s claim that we didn’t properly notify players regarding the August 2012 security breach is not true. Not only did Blizzard act quickly to provide information to the public about the situation, we explained the actions we were taking and let players know how the incident affected them, including the fact that no names, credit card numbers, or other sensitive financial information was disclosed. You can read our letter to players and a comprehensive FAQ related to the situation on our website.
The suit also claims that the Battle.net Authenticator is required in order to maintain a minimal level of security on the player’s Battle.net account information that’s stored on Blizzard’s network systems. This claim is also completely untrue and apparently based on a misunderstanding of the Authenticator’s purpose. The Battle.net Authenticator is an optional tool that players can use to further protect their Battle.net accounts in the event that their login credentials are compromised outside of Blizzard’s network infrastructure. Available as a physical device or as a free app for iOS or Android devices, it offers players an added level of security against account-theft attempts that stem from sources such as phishing attacks, viruses packaged with seemingly harmless file downloads, and websites embedded with malicious code.
When a player attaches an Authenticator to his or her account, it means that logging in to Battle.net will require the use of a random code generated by the Authenticator in addition to the player’s login credentials. This helps our systems identify when it’s actually the player who is logging in and not someone who might have stolen the player’s credentials by means of one of the external theft measures mentioned above, or as a result of the player using the same account name and password on another website or service that was compromised. Considering that players are ultimately responsible for securing their own computers, and that the extra step required by the Authenticator is an added inconvenience during the log in process, we ultimately leave it up to the players to decide whether they want to add an Authenticator to their account. However, we always strongly encourage it, and we try to make it as easy as possible to do.
Many players have voiced strong approval for our security-related efforts. Blizzard deeply appreciates the outpouring of support it has received from its players related to the frivolous claims in this particular suit. Source: IGN
The impetus behind this claim is the security breach back on August the 10th when data such as email addresses for users outside of China were taken, for North American servers the answer to the personal security question and information relating to Mobile and Dial-In Authenticators were accessed. Blizzard maintained that this information alone was not enough to gain access to Battle.net accounts.
Bell claims that players have to buy authenticators (sales of which grossed $26m) to keep their accounts secure when this level of security should be provided by Blizzard as a matter of course. Further that this information was not made clear at the time of purchasing the game. Blizzard counter that the authenticators are a secondary level of security protecting accounts that have had their password stolen outside of Blizzard, i.e email phishing, viruses and malicious code.