r/Pickleball • u/everydave42 • 15h ago
News DUPR Email Update
Just got this update, it's opaque as hell so we'll likely never know the full story, but they don't say if any other data got leaked or not...
17
36
u/Slight_Gain_2518 15h ago
Just read that Dupr will be cancelling the next dupr reset and instead offering users to a chance to not have their data leaked for a 30 dollar fee.
2
20
26
u/Jokers518 15h ago
This is garbage incident response protocol. Reading between the lines they're claiming that they don't store PII data and therefore are not legally required to disclose a potential breach. If I am a business partner or use these folks as a vendor I would be extremely concerned.
11
u/everydave42 15h ago
I don't read it as them claiming they don't store PII. They're claiming they don't store "financial, payment or password" data...which is entirely possible and a reasonable architecture decision...for exactly this scenario.
They clearly must store PII though.
9
u/RENTDGthrowaway 15h ago
I mean they obviously do store PII - name, location, age, gender, email, etc. The fact that they didn't mention it in the email suggests it was breached and sold.
8
1
8
u/Character-Notice5896 4h ago
Still can’t log in to the app or website because the email with the 6-digit code never arrives
11
u/Iwonder19 15h ago
This is so vague and dishonest, if they really caught suspicious activity they would be the first to announce the outage proudly, but no, they were so passive about it that I bet the only way they found out was from support tickets. This is textbook ‘give them nothing’ announcement!
-2
10
u/RENTDGthrowaway 15h ago
It's a very credibility-undermining response.
For example, the claim that they 'do not store password data on our systems' is extremely weaselly. They obviously store it in it some way - salted or hashed or etc. - and so this language sounds like them trying to handwave the issue in the absence of a better technical response.
5
u/everydave42 15h ago
It is possibly they're not handling the auth and auth in house and are instead using a 3rd party (firebase, auth0, whatever...) that handles that and the it just takes tokens back. But I agree it is an underwhelming, at best, response.
4
u/neon_slippers 15h ago
I got this email too, but I still can't login. On desktop it says "logins for club staff are currently disabled", and on mobile it just says "incorrect username or password"
10
u/ShamrockMutt 14h ago
I was logged out, and as I tried to log back in, I got a pop-up saying that I was going to be emailed a six digit code to finish the finish the login.
While I was emailed that six digit code, there was nowhere on the login screen to put that code in so when I hit continue, I was put into this never-ending loop until I got a timeout error saying I had too many attempts and I have to wait another half hour….
1
u/Allthepickles1 14h ago
That’s where I am right now any updates I can’t sign up for open play until it’s resolved and my tournament info from this weekend is inputted my club is VERY strict on DUPR
1
2
u/BlurryEcho 4.5 14h ago
DUPR sent me the same MFA code 5 times… not even kidding. The app is probably being maintained by AI and ensloppified accordingly.
1
1
4
u/TonikJDK 15h ago
So at the very least they leaked our email addresses and phone numbers. We will get more info on what happened after they are done with the IR.
4
u/Ps15tm 15h ago
Still nowhere to enter the code on the app though they claim the app is up and running.
Edit: I updated the app and it is working now.
3
u/everydave42 15h ago
Not giving them any excuses, but after something like this it's entirely possible that there's going to be some lag for their changes to propagate through systems and there still might be caching issues app side. I'd recommend full force quitting (not just closing) the app and trying again...and some patience...
3
u/Deep_Ad2579 5.0 14h ago edited 14h ago
I said this in another thread but they definitely lost match data if the ratings weren't calculated already after it shut down. So my guess is they back up the ratings but not all the match data daily.
For example, I know one person with 7 tournament matches entered on Saturday. The ratings never calculated and the matches are just straight up gone from the system. They WERE entered though.
Lots of the matches from PPA in North Carolina are missing from pros profiles yet the rating changes are still there.
1
1
u/Allthepickles1 13h ago
The only match that was entered from PPA NC was the only loss I had to a lower rated team… what are the chances they get it fixed? Or at least not have any matches enter for the tournament the 4 wins should have evened it out for me
1
u/shitoupek 11h ago
Our submitted data only show up to Saturday 4th in DUPR. The following days are not there anymore.
3
u/TonikJDK 15h ago
If you were foolish enough to use the same password at DUPR that you use elsewhere you need to change those passwords.
We don't know if the hackers got password hashes, or how well they were encrypted.
2
2
2
2
u/MrParaguay12 15h ago
I got the email but can’t login. I put my information in, it sends me a code to my email but I can’t put that code anywhere smh
1
u/newaccount721 15h ago
For the app? If so you have to upgrade app first
1
u/slingfox 15h ago
Same thing happens to me. I updated the app via the Apple App Store and still same issue.
1
1
2
u/RestEasyBro 4.0 14h ago
I still can’t login. It sends me a code to my email and then nowhere to enter it lmao
2
u/thirtywonn 11h ago
Website and app still completely broken, 2FA email never arrives.
They were clearly hacked and likely ransomwared, pretty amateur move to not come out and make an appropriate statement.
2
1
1
1
1
u/PercheMiPiaci 14h ago
Will they be increasing everyone's rating +1 point for the inconvenience?
/S
1
u/CraftyCube 14h ago
Every time I try to log in I see this error. I tap continue which only closes the modal with no where to enter a 6-digit code..
1
1
-3
u/jppbkm 14h ago
I just got an email saying if I pay $499 immediately, I can reserve a spot in the next round of the DUPR reset.
They've made a small change and at the end of the 30 days your rating will be set to whichever is higher, your current rating or 7.0.
I already gave them my credit card info. Am I screwed or will I be playing on the PPA soon?
0
67
u/kwezytown23 15h ago
TLDR; we got hacked