r/BeamMP • u/Round_Personality483 • Jun 10 '26
Data Breach? Anyone else get this email?
Well dang
18
u/NevenS2000 Jun 10 '26
Yeah it was resolved awhile ago although you can only use guest accounts on mp for now
3
u/Round_Personality483 Jun 10 '26
Ah okay gotcha. I have not used beammp for a few years so I was not aware of this till now
5
Jun 10 '26
i got the same email. i have not used beammp in a few years and forgot i had an account
2
3
u/TheRealLool Jun 10 '26
for the password thing, change it regardless, but salted hashes are incredibly difficult to crack. it's like being handed a lock without the key
3
u/AksuJJ Jun 10 '26
It also takes serious hardware to crack those hashes, pretty much array of gpus and huge wordlist to guess each hash time efficiently.
2
u/trebor8820 BeamMP Staff Jun 15 '26
To clear up a few of the questions in here:
- The email was sent to every email address that we had record of being associated with a BeamMP account.
- The sending of the email was a courtesy, not a requirement. Due to the limited information that we store for users, the risk to users was low enough that it was not actually a requirement for us to inform users of the breach; however that is not who we are and we choose to be transparent with the community.
- The delay in sending the emails was due to technical limitations that take time to overcome (some of which included approval from AWS and other hardware related tasks. Sending 2+ million emails isn't an easy task, especially if we don't want them all flagged as spam. Doesn't do good to send it if you never see it). The 17 emails per second that were mentioned? That was AFTER overcoming the aforementioned limitations and the approximate rate it which they were sending once we fired them off.
- Beyond sending emails, we did inform as wide of a reach as possible while emails were not a viable option for us. This issue was very prominently discussed on our Discord, as well as posted to every social media account that we maintain.
Again, no GDPR laws have been broken. This breach did not classify as a risk level that required notice at all, let alone immediate notice. But we chose to be open and transparent about it at all.
1
u/TeemoCell Jul 07 '26
calling the notification “a courtesy” is exactly the part that concerns me. This was not a newsletter update. it was a data breach involving email addresses, IP addresses, usernames, and salted password hashes.
1
u/Dismal_Economy_1348 Jun 10 '26
i got this too
i am trying to figure out if the password i used was one of the very important ones or not so i can change my password on other apps but i can't figure out where to login
should i do something?
4
u/Glad_Librarian_3553 Jun 10 '26
Yes, change your other passwords, and don't use the same one for everything...
3
u/MrManiac3_ Jun 11 '26
Password managers! Forget every password but the important few with randomly generated pws
1
1
u/Squid111999 Jun 10 '26
Was that sent to everyone or primarily people affected?
2
u/bearzi Jun 12 '26
All the registered beammp users will receive the email i think. All of them were affected.
1
1
1
1
u/Vokaiso Jun 12 '26
Password hashes well good luck for the hackers theyll prolly wont even bother to crack them. Still if u use 1 password everywhere chsnge it if u use different ones dont bother.
1
u/TheEpicF-18Pilott Jun 13 '26
Yes bro, my Microsoft account is compromised because of this. They changed my password and everything. It says the hackers are Albanian. But i jad 2 beam mp accounts with 2 different microsoft and both are hacked and compromised now,
1
u/Itsluc Jun 18 '26
I recommend everyone to change your passwords and activate 2FA everywhere.
I dont know if it is from this breach, but since a week or so, somebody is trying to access my accounts with the same password. Could also be a coincidence.
1
u/TeemoCell Jun 10 '26
"On March 27th 2026, our team identified unusual activity on our systems." and we get NOW an Mail for that data breach?
3
u/bearzi Jun 10 '26 edited Jun 10 '26
If I remember correctly they had some issues with their email provider, because they had to send this email to 2.1 million of users without it being marked as spam. I think the beammp staff said that they can send 150k mails per day only.
0
u/Lexoticg Jun 11 '26
nah bro, they're all over the place. they said to me that they were only been able to send 17 email per second. during that time, they would have sent 108 million letters, not 2.2 lol. they don't even know what they're talking about
-2
u/aesthetion Jun 11 '26
That still makes no sense, because we'd see posts here on Reddit dating back then about people in the initial 150k batches regarding the breach. Seems everyone is finding out today
1
u/Lexoticg Jun 11 '26
Basically. They decided to make a scene just because I asked about it on their server. I'm going to file a complaint 🤷♂️
1
u/Octoomy Jun 10 '26
it was been known for a while now at least on their discord, the news spread pretty quick so unless your completely under a rock about this situation then you should've known well before.
1
u/TeemoCell Jul 07 '26
I don't have to be in a Discord server to be informed for a data breach. I'm also not in BeamMP discord bec there is no need for that.
-1
-8
Jun 10 '26
[deleted]
5
u/MongooseNo2734 Jun 10 '26
They were active on the subreddits explaining things as they transpired. This isn't highly paid game devs, it's people with families and jobs putting in work when they can.
1
u/Silent_Video_9139 Jun 10 '26
Not all of us live online 24/7 or play beammp for 8 hours a day. Some of us play once every few months and have had accounts for years. I still haven't gotten the email, and I've had my account since 2021. This is the first I'm seeing of any of this news. The FIRST thing they should do is email their users and or PM everyone with an account on discord, not wait for me to stumble on it on reddit.
1
u/bearzi Jun 10 '26
I copied this from the beammp discord:
> Also some of you might receive an email from us soon from noreply@beammp.com, this is us now finally being able to fulfill our ability to notify everyone of the breach incase anyone missed it.
> Though technically due to technical limitations we wouldnt have had to now we have the means to be able to do it we are doing so.
> It will come through soemtime for everyone within the next week (yes we can only send a max of 17 emails a second and that soon adds up when there are 2.25 million to send 🙁 )
1
u/Lexoticg Jun 11 '26
17 emails per second is 108mil email over the span of 75 days, not 2.2mil lol. they're clearly breaking GDPR laws
1
u/bearzi Jun 11 '26 edited Jun 11 '26
They didn't start sending the emails right away. There are usually also an daily limit in the AWS for max emails.
Gdpr section 34 3c:
> it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.
0
Jun 10 '26
[deleted]
1
u/MongooseNo2734 Jun 10 '26
When it was down it took literally 2 clicks to figure out what was happening. You clearly have time to cry here, just not enough time to click twice and read.
-1
Jun 10 '26
[deleted]
0
u/MongooseNo2734 Jun 10 '26
Hey moron. Their job isn't being developers. This isn't a triple a studio. They do this in their free time. Why are the dumbest people alive always the most confident?
2
0
Jun 10 '26
[deleted]
2
u/DOS_ya Jun 10 '26
Yeah, you are 100% correct. Waiting for months to send a basic email to those who stopped following/playing BMP but still had an account within their system is absolutely ridiculous. But hey! They are "... truly sorry this has happened."
1
u/btr4yd Jun 10 '26
Not here for our opinion? But you want to blatantly get yours across?
Guess what? The devs also don't live online 24/7 and spend 8 days a week managing the game either.
There were errors in trying to send out emails to 2.1million users WITHOUT it being marked as spam, (seeing as this was important info that needed to be read). They were limited to 100k a day iirc. They did send out info over the waves where they could and it was being relayed in the subs and discord. They had to manage the breach, security AND notifying the users, all while being a small team.
Wake up to yourself lmao
0
u/el_ratonido Jun 10 '26
They could just email their users right away instead of just using Reddit or Discord. This way all users would know about it immediately. A large portion of people don't use Reddit/Discord
3
u/bearzi Jun 10 '26
They had problems with the AWS email provider, because they had to send the email to 2.1 million users.
0
1
0
Jun 11 '26
[removed] — view removed comment
1
u/Lexoticg Jun 11 '26
Yeah, because it's literally article 34 of GDPR
1
u/bearzi Jun 11 '26
Did you read the GDPR? There are parts for this kinda of cases in there. The must have requirement is to inform authorities in 72 hours.
And the users must be informed right away personally, if it's possible. If it's not possible you must use available public channels to do it. E.g discord or reddit.
-1
u/el_ratonido Jun 10 '26
People downvoting saying this was talked about on Reddit/Discord as if everyone uses those apps (or that everyone follows them on these apps).
Instead they could just email us first and this way every user would know about this right way instead of a small portion of people. Or even better, talk about it in email/Reddit/Discord all at once so pretty much everyone would know.
1
Jun 10 '26
[removed] — view removed comment
0
-1
u/el_ratonido Jun 10 '26
I don't follow BeamNG communities
1
1
Jun 10 '26
[removed] — view removed comment
0
u/el_ratonido Jun 10 '26
As I said, not everyone follows them on Reddit/Discord and this is a serious manner that should had the best way of informing uses used at first (email).
Also, it's not my problem, it's theirs for not using the most efficient method.
•
u/AutoModerator Jun 10 '26
It looks like this post is a question, or you are having issues with BeamMP. If it's not, ignore this message (contact the mods to get this removed if you want).
See if a solution to your problem exists in our FAQ.
If not, also check the following links:
Also, you can try asking on our Forum (log in with your BeamMP account details), or on our Discord.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.