Pokémon resets some users' passwords after hacking attempts

The Pokémon Company said it detected hacking attempts against some of its users and reset those user account passwords.

Last week, an alert was visible on Pokémon’s official support website that said, “Following an attempt to compromise our account system, Pokémon proactively locked the accounts of fans who might have been affected.”

As of Tuesday, the alert is gone. A spokesperson for the company said there was no breach, just a series of hacking attempts against some users.

“The account system was not compromised. What we did experience and catch was an attempt to log in to some accounts. To protect our customers we have reset some passwords which prompted the message,” said Daniel Benkwitt, a Pokémon Company spokesperson.

Pokémon is a wildly popular game franchise with hundreds of millions of players around the world.

Benkwitt said that only 0.1% of the accounts targeted by the hackers were actually compromised, and reiterated that the company already forced the impacted users to reset their passwords, so there isn’t anything to do for people who have not been forced to reset their passwords.

The description of the Pokémon account breaches sounds like credential stuffing, where malicious hackers use usernames and passwords stolen from other breaches and reuse them on other sites.

A recent example of a similar incident is what happened last year to the genetic testing company 23andMe. In that case, hackers used leaked passwords from other breaches to break into the accounts of around 14,000 accounts. By breaking into those accounts, the hackers were then able to access the sensitive genetic data on millions of 23andMe account holders.

That prompted the company (and several other of its competitors) to roll out mandatory two-factor authentication, a security feature that prevents credential stuffing attacks.

For its part, the Pokémon Company does not allow its users to enable two-factor on their accounts, when TechCrunch checked.