¶ ile paragrafa bağlantı verin veya alıntıyı künyesiyle kopyalayın. Üretilen bağlantı kimlikleri resmî paragraf numarası değildir.
THE HESSIAN COMMISSIONER
FOR DATA PROTECTION AND FREEDOM OF INFORMATION
11 November 2020
Final Decision
Complaint against – Personal Data Breach (Articles
33 and 34 GDPR), Security of Processing (Article 32 GDPR)
IMI A56ID: 64211
IMI Case: 72377
IMI A61VMN: 151854
IMI A60DD: 156281
The Hessian Commissioner for Data Protection and Freedom of Information (hereinaf-
ter “HBDI”) refers to the complaint lodged by Mr. . (hereinafter “Complainant”)
against (hereinafter “ ”) with the Dutch Data Pro-
tection Authority concerning a possible security breach in the authorization process of
servers.
1. Case description
The Complainant has reported a possible security breach in the authorization process
of certain servers through the ethical Hacker program “HackerOne”.
According to the Complainant, the personal data that could be reached through the
breach were for example friend lists.
has replied to the Complainant that this incident was a known issue and that
they are implementing measures.
On 23 September 2020, the Dutch Data Protection Authority informed the HBDI that
the Complainant considers the problem solved and wishes to withdraw his complaint.
2. Investigation outcome
HBDI contacted in July 2019. In its answer, confirmed that a possi-
ble security breach had been reported through the platform “HackerOne”.
has explained that in the underlying HackerOne Report a point of attack was
described, which concerned so-called matchmaking servers of the older gen-
eration of the and the . These are
servers that are used to carry out matchmaking for games of the above-mentioned
platforms with online multiplayer function, in which players are assigned other
Page 1 of 4
____________________________________________________________________________________________________
Gustav-Stresemann-Ring 1 65189 Wiesbaden Telephone +49 6 11 14 08 – 0 Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] Web www.datenschutz.hessen.de
Draft Decision – IMI Case 62334
Page 2 of 4
____________________________________________________________________________________________________
players to the online game according to criteria defined by the system and internal
rankings/leaderboards are calculated for the participating players. For each individual
game title with corresponding functionality, there is a separate matchmaking server.
The matchmaking servers are created in the system architecture as logical servers.
To be distinguished from the matchmaking servers and not the object of the reported
attack are the actual account servers. On these account servers, if created by the user,
the user account - on the in question this is the
- is administered, which contains the information deposited by the user when regis-
tering the , such as the email address or other data required for
the identification of the user.
Due to the limited functionality of a matchmaking server, it contains only very limited
data. This is mainly technical information necessary for matchmaking, such as re-
gion/time zone and skill level to be able to assign adequate opponents to the players,
as well as dynamic IP addresses of players currently in matchmaking to enable the
establishment of a peer-to-peer connection between them. The dynamic IP address
itself is not stored in the matchmaking server.
In addition, the users and friends connected to the users (referred to as friend lists in
the complaint) are assigned internal identification numbers on the matchmaking server
which do not allow third parties to identify the players themselves and do not contain
contact information of the users, contrary to what is claimed in the complaint.
A further functionality of a matchmaking server is the mapping of in-game (visible to
other players) rankings/leaderboards of players involved in an online multiplayer mode.
Furthermore, if supported by the respective game title, scores achieved by the user in
the game, game scenes saved by the user (so-called replay data), a public mail in the
game or, for example, the items of clothing selected for a game character can be stored
on the servers.
The general procedure in case of reported possible points of attack, which was also
used in the present case, initially provides for a comprehensive technical analysis. One
measure taken is the development of appropriate patches to close the point of attack.
In addition, the package of measures can provide for the shutdown of individual af-
fected servers in individual cases. For servers where patching requires less technical
effort, the detected attack points are closed first.
As a direct result of the report, conducted a comprehensive analysis of the
named point of attack and discovered the weakness in user authentication described
in the report on older matchmaking servers of the aforementioned older plat-
forms. As a result of this analysis and taking into account the relevance and user ac-
tivity on affected matchmaking servers, started to close the attack point and
to patch affected servers according to the previously mentioned criteria in order to pro-
tect the servers from corresponding hacker attacks. The matchmaking server for the
Page 2 of 4
____________________________________________________________________________________________________
Gustav-Stresemann-Ring 1 65189 Wiesbaden Telephone +49 6 11 14 08 – 0 Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] Web www.datenschutz.hessen.de
Draft Decision – IMI Case 62334
Page 3 of 4
____________________________________________________________________________________________________
game named in the report was already
patched in December 2016. The incident was also investigated with ’s exter-
nal data protection officer.
A manipulation of the matchmaking servers could not be detected during the analysis.
The point of attack depicted in the report concerns exclusively older matchmaking serv-
ers of game titles for the and of the . These are
both older models, many of which have not been produced or distributed by
for years, and game titles that generally have low user activity. As correctly described
in the complaint, the matchmaking servers for game titles of the current gen-
eration of the are not affected.
In ’s opinion, the described facts do not constitute a notifiable violation of the
protection of personal data pursuant to Article 33 or 34 GDPR.
The data stored on the matchmaking servers is primarily technical data which
can link internally with a user account and thus subjectively allow to identify
the user. does not request any clear names via the existing account systems
which are not the subject of the attack and does not use selected user names (so-
called nicknames). According to the user agreements, which the user agrees to, user
names may not contain any clear names. For a third party, however, the necessary
personal reference is missing because a third party cannot identify the persons behind
the users with the data on the matchmaking servers. This is especially true for dynamic
IP addresses which are only available in real time and are not stored in the matchmak-
ing Server. Third parties lack the legal and factual means to identify a natural person
behind the user. At most, at the time the connection is established, it is possible to
roughly determine the regional dial-in node of the user with whom the hacker exploiting
the point of attack is initiating a matchmaking process. However, this may differ con-
siderably from the actual location of the person. A general "reading" of all online players
connected via the matchmaking server and their assigned dynamic IP addresses,
which must be shared between the users in order to establish the peer-to-peer con-
nection, was not possible via this point of attack.
Moreover, access to the matchmaking servers concerned is not possible without fur-
ther ado, but requires advanced hacking capabilities.
Nevertheless, states to take the security of their servers very seriously and
has therefore taken the steps described above.
is of the opinion that even on the assumption of a personal data breach, an
unauthorized break-in into the server using the corresponding criminal energy and ac-
cess to the data stored there would in all probability not lead to a risk to the rights and
freedoms of natural persons. The data concerned is not data with which an attacker
could cause harm to a data subject, e.g. through identity theft, let alone identify a per-
son.
Page 3 of 4
____________________________________________________________________________________________________
Gustav-Stresemann-Ring 1 65189 Wiesbaden Telephone +49 6 11 14 08 – 0 Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] Web www.datenschutz.hessen.de
Draft Decision – IMI Case 62334
Page 4 of 4
____________________________________________________________________________________________________
3. Decision
In the course of the investigation, the HBDI has found that the reported incident does
not constitute a personal data breach within the meaning of Articles 33, 34 GDPR since
personal data of users is not concerned. The incident had only minor impacts
(without data protection impact) and has been adequately resolved.
The Complainant also considers the problem solved and has withdrawn the complaint.
In its Draft Decision of 13 October 2010 the HBDI has informed the supervisory au-
thorities concerned accordingly. No objections to the Draft Decision were raised.
The HBDI therefore concludes the proceedings with this Final Decision.
The Hessian DPA
Page 4 of 4
____________________________________________________________________________________________________
Gustav-Stresemann-Ring 1 65189 Wiesbaden Telephone +49 6 11 14 08 – 0 Fax +49 06 11 14 08 – 9 00 (or – 9 01)
Email [email protected] Web www.datenschutz.hessen.de