Fortnite Teen Hackers 'Earning Thousands of Pounds a Week'

Children as young as 14 are making thousands of pounds a week as part of a global hacking network built around the popular video game Fortnite. The game has more than 200 million players. About 20 hackers told the BBC they were stealing the private gaming accounts of players and reselling them online.

Fortnite is free to play but is estimated to have made more than £1bn through the sale of "skins", which change the look of a character, and other add-ons. This fuels a growing black market. Hackers can sell player accounts for as little as 25p or hundreds of pounds, depending on what they contain.

The items are collected as in-game purchases but are purely cosmetic and do not give gamers any extra abilities. Fortnite-maker Epic declined to comment on the investigation but said it was working to improve account security.

Felt Horrible

One British hacker said he got involved at the age of 14 earlier this summer, when he himself became the victim of a hack. Speaking from his bedroom via a video chat, wearing a baseball cap and bandana to hide his identity, the teenager said he had spent about £50 of his pocket money to build up a collection of skins, when he had woken up to a message that changed everything.

"The email said that my password had been changed and two-factor authentication had been added by someone else. It felt horrible," he recalled.

Two-factor authentication meant his account could only be accessed by entering a code sent to an email address or app registered by the perpetrator.Like many victims, he turned to Twitter to vent his frustration. That was where he saw new accounts containing even better items on sale.

"I was approached by someone who said I could buy an account for 25p and I could clearly see the account was worth a lot more," he recalled.

I Bought it!

He knew he was playing on a stolen account but with so many others doing it online and making lots of money, he was soon drawn into the world of "Fortnite cracking".

"I was approached by a cracking team and they told me what it was and all about 'combos', 'proxies' and I guess they showed me how to crack," he said.

Lucky Dip

He said they showed him where to find the vast lists of usernames and passwords published online from other data breaches over the years. They showed him where to buy "off-the-shelf" hacker tools needed to input those credentials into the login page of Fortnite. Once inside an account, they showed him how to take it over and then sell it to the hungry online community.

He insisted that he only carried out one cracking session. But in that single day he managed to access more than 1,000 Fortnite accounts.

"It's lucky dip basically, you either get a good account or you don't. People like the rarity of the 'skins' and it's about the look of them and showing off to friends."

The hacker said he was now a middleman for other crackers, selling on accounts he knew to be stolen. In his first few weeks, he made around £1,500 and bought himself some games and a new bicycle. He said he knew what he was doing was illegal, but his parents were aware of his activities and had not stopped him. Offences like this fall under the Computer Misuse Act and carry a possible prison sentence of two years.

Some hackers show no signs of remorse or concern. One of the most prolific is a 17-year-old from Slovenia, who sells through his own website. "You can't get caught, nobody checks it," he told the BBC from within the game.

Amidst the gunfire and wall-building, he said he had made £16,000 in the seven months that he had been cracking.

He said his mother was an accountant who was helping him save for a first car. He sent screenshots of his PayPal accounts and Bitcoin wallets to confirm his business was real. Another hacker showed proof of earnings ranging from £50 a day to almost £300. The 15-year-old from France said his best week netted him £2,300.

"Yes I have done other stuff but nothing too big," he added, referring to identity fraud among other cyber-crimes.

The National Crime Agency says there is a long-standing link between video games and hacking, and that publishers need to do more to prevent players being tempted into crime.

"What we want to see these companies do is not look at this from a purely technical standpoint," said the agency's lead on gaming, Ethan Thomas.

"What we'd like... is the gaming industry engaging more with law enforcement and looking at early intervention messaging on their platforms to divert [youngsters] on to a more ethical and legal path."

Debbie Tunstall runs rehabilitation days for low-level hackers who have been caught. She is concerned about networks like Fortnite's cracking community.

"We know that these sorts of activities are linked to organised crime and we know that they are being egged on by more dangerous people behind the scenes," she explained.

"There is definitely cyber-crime grooming taking place and if we don't act they could easily get taken down that route."

The issue of account hacking on Fortnite was first brought to the attention of Epic in March, when it said it was looking into the problem.

Hackers say it makes it extremely hard for them to access an account if players add two-factor authentication to their own accounts.Epic encourages the security measure by rewarding those who adopt it with in-game accessories but has opted not to make the step mandatory.

BBC:

You Might Also Read:

Hackers Are Targeting Young Video Gamers:

« Quantum Computing – Advantage Or Security Threat?
Cybercrime Gangs Continue To Innovate »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Securezoo

Securezoo

Securezoo's mission is to simplify and enhance information security by providing trusted security guidance, products, and information to small and mid-sized businesses and security professionals.

Critical Infrastructures for Information and Cybersecurity (ICIC)

Critical Infrastructures for Information and Cybersecurity (ICIC)

ICIC addresses the demand for cybersecurity for National Public Sector organizations and civil and private sector organizations in Argentina.

BPC Banking Technologies

BPC Banking Technologies

BPC’s advanced fraud prevention solution helps card issuers and acquirers combat the growing threat by monitoring 100% of transactions, online, in real-time across all channels.

SafeLogic

SafeLogic

SafeLogic provides strong encryption products for solutions in mobile, server, Cloud, appliance, wearable, and IoT environments that are pursuing compliance to strict regulatory requirements.

Bio-Morphis

Bio-Morphis

Bio-Morphis Reflex solution is a paradigm shift in the approach to information systems security.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Newtech Recycyling

Newtech Recycyling

Newtech Recycyling specializes in the removal and disposal of IT infrastructure which has reached the end of its life cycle.

Blockchain Reactor

Blockchain Reactor

Blockchain Reactor is a blockchain consultancy and implementation company providing cutting-edge blockchain solutions for start-ups and enterprises.

Drootoo

Drootoo

Drootoo is transforming businesses and making them high performing entities with its unified cloud platform.

SOC Experts

SOC Experts

SOC Experts is a pioneer (we started SOC training well before people realized how big the domain was going to be) and the only institution to provide end-to-end training on Security Operations Centers

AirITSystems

AirITSystems

AirITSystems offer companies comprehensive IT security solutions that take all security considerations into account and are tailored to your business.

Melius Cyber Security

Melius Cyber Security

Melius Cyber Security has developed a world-leading SaaS platform, Cyber Safe Plus, built around continuous assessment and improvement through vulnerability scanning and penetration testing

NightDragon

NightDragon

NightDragon is a venture capital firm investing in innovative growth and late stage companies within the cybersecurity, safety, security, and privacy industry.

Cheops Technology

Cheops Technology

Cheops is a specialist in IT Business Technology Services. We help SMEs and large companies build, optimize and manage their IT so they can focus on their core business.

Buchanan Technologies

Buchanan Technologies

Buchanan Technologies is a leading IT consulting and outsourcing services firm. Our methodology transforms everyday technology investments into streamlined, secure and scalable solutions.

Security Mind

Security Mind

Security Mind is an innovative Cyber Security Awareness program that aims to increase the awareness of each member of the organization and develop the ability to recognize potential cyber threats.