Information Regarding the Events of 6.12.2018

On December 6th, 2018 at 13:01 GMT an update was pushed to GmodStore enabling micro-caching in an attempt to reduce the effects of an ongoing DDoS attack against our web store. With the addition of this update, when pushed through our pipeline, unintentionally led users to experience sessions of accounts that were not their own. This had allowed them to perform actions under said accounts.

We quickly solved this issue and affected users were messaged, however we are making an additional announcement to ensure our users feel safe and fully understand the event with what happened and why it happened. If you have any further questions after this announcement, please feel free to personally contact me if you wish to know anything further.

Upfront and foremost we are incredibly sorry to our affected users.

Timeframe of events:

1. At 13:01 GMT the microcaching update with the intent of mitigating ongoing DDoS was pushed with the resulting bug.
2. At 13:15 GMT some of our online users reported they were logged in as other users, we immediately investigated and confirmed via our event log.
3. At 13:20 GMT we enabled Cloudflare Access preventing anyone from using the site until we fixed this and invalidated all sessions at 13:30 GMT.

During this timeframe we were able to identify exactly who was affected and exactly what actions were performed thanks to our event log. During the small time frame 3 users had their purchases downloaded and one administrator account was accessed to change normal users’ permission groups, using this one user edited the price of VCMod, this was reversed and the permission reset, no other events occurred using this.

The affected users were messaged privately.

We also believe that our internal “financial reports” were accessed, we want to ensure everybody that these contain no user data and are merely reports we send to HMRC quoting the exact amounts of tax we need to pay each EU member state for goods sold on our store.

Edit:

People are asking about what exactly is given in the financial reports; It's a list of countries and the VAT collected/paid to them, zero user information:

Edit 2:

Moderators, administrators, developers and community manager is now required to use 2FA, and any and all moderator/admin actions are now protected by 2FA.