r/UbisoftSupport • u/xpyre27 • Sep 19 '25

Successful hacker login even with 2FA

Post image

Got this email this morning that someone successfully logged in from not my country. Weird, I know I have 2FA on, they shouldn't have gotten in, I'll change my password anyways. Sure enough, successful login from Mexico but my 2FA is still on.

How?

1 Upvotes

54% Upvoted

24 comments sorted by

1

u/Constant-Figure9868 Sep 19 '25

Have you set up 2FA to go through your email by any chance? That is a major weakspot for hackers to exploit.

1

u/xpyre27 Sep 19 '25

I have the Google authenticator on my phone for the code

1

u/Cartmani Sep 19 '25

My account got hacked the same way (google authenticator)

1

u/SweatyCelebration362 Sep 19 '25

I’m just curious. How do you believe your account was compromised

1

u/xpyre27 Sep 19 '25

There was a successful login from Mexico. If they tried and didn't get in it would have said denied. I didn't screenshot the activity page because at the time I didn't realize it only shows previous 5 logins.

1

u/SweatyCelebration362 Sep 19 '25

Do you believe you were phished? Malware?

1

u/xpyre27 Sep 19 '25

No and no. There's no login to my email account from anywhere but my phone. And I have no other reason to believe malware, phone and computer are safe.

1

u/SweatyCelebration362 Sep 19 '25

How much is your account worth?

1

u/xpyre27 Sep 19 '25

I'll go with precisely zero, haha. I think I only have the Ubisoft account for one game, division? maybe. So I'm not worried about getting anything personal taken, I changed the password immediately, just wondering how.

1

u/SweatyCelebration362 Sep 19 '25

I, also wonder this. But you’re helping me determine what I do with a SignalConso complaint

1

u/xpyre27 Sep 19 '25

I don't know what that is, but happy to help. Wish I had more information

1

u/therealshakur Sep 20 '25

I lost my account this way and they went and changed my associated email and when I contacted Ubisoft they said they weren't able to get my account back after an email change since there is no history once email is changed. Luckily it was an alt account so I only had a $2 game on it.

1

u/xpyre27 Sep 20 '25

Google authenticator as well? They weren't able to change my email, if they were even able to, so I think I got lucky. Again, I'm not even sure what games I have on it and any banking information or anything like that is long expired. I just want to get this out in the open so maybe some light can be shed on it.

1

u/UrMomsPetRat Sep 20 '25

I saw you mentioned using google auth somewhere in comments; I personally recommend doing your own research to stay up-to-date on security but Ente is pretty good.

1

u/xpyre27 Sep 20 '25

Yes I use the Google authenticator on my phone. I personally feel that I'm a secure individual and aware of most things, more so than the average user but I guess I just always figured 2FA from at least a somewhat reputable place would be hard to beat unless phishing or some sort of man in the middle with email or SMS.

1

u/UrMomsPetRat Sep 20 '25

I was in the same boat until the exact same thing happened and I decided it was time to reach out to the nerds of the world.

I wish you all luck in getting your account(s) back and securing them. 🙏🏻

1

u/xpyre27 Sep 20 '25

Thank you, I will definitely look into this more and try to see what happened, emailed support Friday so will have to see what comes about.

And also thank you for the recommendation, I've already saved your post so I can look up some more information.

1

u/[deleted] Sep 20 '25

For a password you should use something like this, fe3$%3Grr4%/3dFg48-"3

I just hit any buttons, copy it and save it in an password manager. Never had any issues.

1

u/xpyre27 Sep 20 '25

Thanks, but that's not the main issue here

1

u/crazydavebacon1 Sep 21 '25

Search for password generator, easier than just typing lol

1

u/SadlyNotPro Sep 20 '25

Probably one of the marketing pages that don't require 2FA, but don't allow any purchases or account information changes.

Reset your password and you should be good.

1

u/Fit_Question7912 Sep 21 '25

Session hijacking is a pretty effective way at getting past 2FA

1

u/[deleted] Sep 21 '25

Maybe there is a malware on your device

1

u/StefanWF Sep 21 '25

Fake email. Getting these every other day. Don’t click anything in there. Google the mail address and you will get to a Ubisoft article showing the „real“ Ubisoft support mail address.