Goddess of Victory: NIKKE publisher confirms PC launcher breach exposed players to security risks, offers guides on identifying and dealing with malware. Inquiries about financial losses open

Following a November 3 announcement that the PC launcher of Goddess of Victory: NIKKE showed signs of being compromised by a third party, publisher Level Infinite released an apology on November 4 and confirmed that the recent incident put PC players at risk of potential security threats. Security measures and fixes for the launcher have been implemented, with detailed guides for players to verify the security of their systems. In-game compensation items have also been distributed to all players regardless of which platform they are on. 

According to Level Infinite’s security incident timeline, an open-source domain used by some of the publisher’s game services was hijacked by a third party on September 27. The third party tampered with the NIKKE PC launcher’s script files on the same day (over a month before the incident was discovered). Malicious programs (reportedly a remote-controlled agent) then started being distributed to players’ PCs through the compromised script on October 30.  

It was on November 4 that anomalies were detected in the launcher script files, prompting an investigation and response efforts. The abnormal script files were replaced on the same day. The CDN cache refresh was completed for the remaining abnormal script file, followed by the gradual deployment of the corrected file across the relevant CDN nodes. 

A feature has been added to Goddess of Victory: NIKKE’s PC version that allows players to easily detect and remove any malicious programs that may have been installed (Level Infinite recommends closing all web browsers before initializing the feature). The full step-by-step guide for checking your system using the PC launcher can be found on the official NIKKE webpage. 

For those who don’t have the game installed (or would like to have more peace of mind), a manual security check guide requires you to check your security logs and delete any abnormal files that you find. 

While the preventive measures remove abnormal files, Level Infinite recommends changing all passwords, API keys, and access tokens on affected PCs. Those who believe they may have been affected or are suffering financial or other losses from the breach are advised to contact the Level Infinite Customer Support Center. 

Moving forward, the publisher plans to conduct a comprehensive review of its security management processes for the PC launcher and all related data with the intention of implementing improvements so that similar cases do not occur again. Security monitoring for the launcher and its related systems will be tightened, and an integrity verification system for external resources access by the launcher will be established. Lastly, improvements to the permissions assigned to each PC launcher feature will be made so that they operate on the minimum requirements. 

Related: SEGA’s major arcade network services down after subsidiary suffers server breach 

Capcom reports large-scale data breach affecting approximately 11.77 million “Capcom ID” accounts. No credit card information compromised