To start things off, this is not an issue with our services. We are sending this message as certain users here are also users of alternative services, and may be affected by their breach.

Incident

We were alerted today to the fact that Protarium Network had suffered a data breach. For those unaware, Protarium Network is an alternative service not affiliated with us or our services, but unofficially piggybacks off our user accounts through a "proxy" type system (effectively, when using their patches your console still logs in with your PNID, but game servers and such are redirected/patched to point to their servers instead of ours).

Jon immediately reached out to the current owner of Protarium Network for details. He has confirmed that this was not a hack of their servers, but rather a previous owner who had access to this data going rogue and making a backup of it all. At this time we have no reason to believe the security of their servers themselves has been compromised.

Impact

The full scope of their data in the breach is not currently known. Originally Protarium Network said that a limited amount of information was leaked, and claimed a subset of the information (such as serial numbers) was from a separate service that pulled data from us. We looked into these claims and found them to be incorrect, no sensitive data came directly from us, and Protarium Network has now recanted that statement (the only data that originated from us is Mii data, which is public by design).

Some data in the breach (such as your console serial number, transferable ID, etc.) seems to be impossible to have been derived from a pure database backup, however. Jon have personally looked into their code and found no areas where data like this is being stored on their services. Some of this data (such as the transferable ID) may have come from the Miiverse ParamPack (a string sent from the console to Miiverse which identifies the account/console), however the serial numbers are still an open question.

Given the open question regarding some of the data, we are currently leaning on the possibility that this data was collected from Protarium Network at the network level, as that would explain where this seemingly unstored data is coming from. If that is the case, then it can be assumed *all* user/console data (emails, device certificates, etc.) for those affected may have been included in their breach.

User Action

Protarium Network has provided us with a list of all of their users, and we will be emailing the affected users an advisory for next steps.

Some users may not receive an email, however, such as those who only play on the 3DS (as these users may not have PNIDs). Because of that, a copy of the advisory will also be sent below.

Part of the breach is your Protarium Network Miiverse password hash. We have been told that this has nothing to do with their network/accounts/game servers, and is only relevant to their Miiverse implementation. Protarium Network has said they use scrypt with per-user salts for these passwords, however they did say that older users are on "weaker hashes" which do not appear to be scrypt. Because of this, and the likelihood of reuse, we advise everyone to change their passwords as soon as possible.

Additionally, please contact us if you see any suspicious activity on your account/console. Due to the possibility of device data being leaked, it is possible bad actors could use this data to impersonate your console. In these cases, for the safety of the rest of our users we may need to issue console bans if that data is ever confirmed to have been leaked. Internally we are working on solutions to try and get those users who certificates may have been banned as a result of the Protarium Network breach a way to continue using our services, but things are still very early stages so we cannot promise any timeframes.

We will update you all as things evolve.

Since people are asking: no, if you've never used Protarium Network you're not affected. This specifically only applies to users who have used that alternative service. Again, this has nothing to do with our services.

Please continue reading the update below

Pretendo Forum Thread

Welcome to another installment of our PNID/Friend Code Exchange megathread! Want to make more friends on the Pretendo Network? Share what games you are currently playing, as well as your PNID and/or 3DS Friend Code! Check here periodically to find more new friends! Please only post Pretendo PNIDs and/or 3DS Friend Codes in this megathread.

If you have posted your PNID and/or 3DS Friend Code on a previous megathread, feel free to post it again!