Thu, Mar 26, 2015 by

On March 25th at 15:54 EST, an unauthorized party gained access to a UGC admin account and sent an email to approximately 400-500 team leaders. Ten minutes after the email was sent, our Admin Panel was taken down as a precautionary measure. The whole ugcleague.com domain, as well as the ugcleague.net domain, on which our Forums are hosted, were taken down shortly afterwards. Early investigations indicate that the unauthorized party had access to our Admin Panel for a period between 30 and 60 minutes. Only the UGC Admin Panel was breached. We have no indication of the attacker gaining access to our database.

During that time-frame, the attacker might have had access to leader passwords. There is no available data dumps or massive download features embedded in the Admin Panel. Any access to leader passwords, if any, was done one at a time. Team Leader passwords are a series of alpha-numerical & special characters auto-generated by the UGC website. However, if you changed the auto-generated password to a custom one or if you use the auto-generated password on other services, we recommend that you take precautionary measures by changing them.

Our developers have been hard at work since the breach this afternoon and are currently implementing additional security measures to the Website. Among other things, passwords have been invalidated and leaders will be required to input a new password upon their next login. Additionally, the new login system will use hashed passwords, in addition to salting.

The past few weeks have not been easy for UGC, however, we wanted to thank you for your continuous support and understanding.

Sincerely, UGC Admins