Children as young as 14 are making thousands of pounds a week as part of a global hacking network built around the popular video game Fortnite.
About 20 hackers told the BBC they were stealing the private gaming accounts of players and reselling them online.
Fortnite is free to play but is estimated to have made more than £1bn through the sale of “skins”, which change the look of a character, and other add-ons.
This fuels a growing black market.
Hackers can sell player accounts for as little as 25p or hundreds of pounds, depending on what they contain.
The items are collected as in-game purchases but are purely cosmetic and do not give gamers any extra abilities.
Fortnite-maker Epic declined to comment on the investigation but said it was working to improve account security.
The game has more than 200 million players.
‘Felt horrible’
One British hacker said he got involved at the age of 14 earlier this summer, when he himself became the victim of a hack.
Speaking from his bedroom via a video chat, wearing a baseball cap and bandana to hide his identity, the teenager said he had spent about £50 of his pocket money to build up a collection of skins, when he had woken up to a message that changed everything.
“The email said that my password had been changed and two-factor authentication had been added by someone else. It felt horrible,” he recalled.
Two-factor authentication meant his account could only be accessed by entering a code sent to an email address or app registered by the perpetrator.
Like many victims, he turned to Twitter to vent his frustration.
That was where he saw new accounts containing even better items on sale.
“I was approached by someone who said I could buy an account for 25p and I could clearly see the account was worth a lot more,” he recalled.
“I bought it.”
He knew he was playing on a stolen account but with so many others doing it online and making lots of money, he was soon drawn into the world of “Fortnite cracking”.
“I was approached by a cracking team and they told me what it was and all about ‘combos’, ‘proxies’ and I guess they showed me how to crack,” he said.
‘Lucky dip’
He said they showed him where to find the vast lists of usernames and passwords published online from other data breaches over the years.
They showed him where to buy “off-the-shelf” hacker tools needed to input those credentials into the login page of Fortnite. Once inside an account, they showed him how to take it over and then sell it to the hungry online community.
He insisted that he only carried out one cracking session. But in that single day he managed to access more than 1,000 Fortnite accounts.
“It’s lucky dip basically, you either get a good account or you don’t. People like the rarity of the ‘skins’ and it’s about the look of them and showing off to friends.”
The hacker said he was now a middleman for other crackers, selling on accounts he knew to be stolen. In his first few weeks, he made around £1,500 and bought himself some games and a new bicycle.
He said he knew what he was doing was illegal, but his parents were aware of his activities and had not stopped him.
Offences like this fall under the Computer Misuse Act and carry a possible prison sentence of two years.
Some hackers show no signs of remorse or concern. One of the most prolific is a 17-year-old from Slovenia, who sells through his own website.
“You can’t get caught, nobody checks it,” he told the BBC from within the game.
Amidst the gunfire and wall-building, he said he had made £16,000 in the seven months that he had been cracking.
He said his mother was an accountant who was helping him save for a first car. He sent screenshots of his Paypal accounts and Bitcoin wallets to confirm his business was real.
Another hacker showed proof of earnings ranging from £50 a day to almost £300.
The 15-year-old from France said his best week netted him £2,300.
“Yes I have done other stuff but nothing too big,” he added, referring to identity fraud among other cyber-crimes.
The National Crime Agency says there is a long-standing link between video games and hacking, and that publishers need to do more to prevent players being tempted into crime.
“What we want to see these companies do is not look at this from a purely technical standpoint,” said the agency’s lead on gaming, Ethan Thomas.
“What we’d like… is the gaming industry engaging more with law enforcement and looking at early intervention messaging on their platforms to divert [youngsters] on to a more ethical and legal path.”
Debbie Tunstall runs rehabilitation days for low-level hackers who have been caught.
She is concerned about networks like Fortnite’s cracking community.
“We know that these sorts of activities are linked to organised crime and we know that they are being egged on by more dangerous people behind the scenes,” she explained.
“There is definitely cyber-crime grooming taking place and if we don’t act they could easily get taken down that route.”
The issue of account hacking on Fortnite was first brought to the attention of Epic in March, when it said it was looking into the problem.
Hackers say it makes it extremely hard for them to access an account if players add two-factor authentication to their own accounts.
Epic encourages the security measure by rewarding those who adopt it with in-game accessories but has opted not to make the step mandatory.
Source: BBC
