To see less ads Register or Login ----- Daily Fantasy Sports games 18+

FPL Team hacked - team name changed, players trf'd

A Fantasy Football forum for news on fantasy football games run by the Premierleague (FPL).
Post Reply
User avatar
bigH
Treebeard
Posts: 267
Joined: 13 Oct 2005, 18:26
Location: Saxmundham, Suffolk
FS Record: FL Golf Major League Winner 2006

FPL Team hacked - team name changed, players trf'd

Post by bigH »

I logged on after last nights games to check my points only to discover that my team name had been changed and various players transferred in/out.

Weirdly, the team name was changed to "@Ben Crellin was here"

I haven't been on FISO for years and had no idea who Ben Crellin was until I googled him and discovered he is a FPL fixtures wiz.

I contacted FPL - they apologised and said that there had been a large number of teams hacked and there wa snothing they could do and just recommended i change my password

Just wondered if anyone else has had the same problem
You do not have the required permissions to view the files attached to this post.
Last edited by bigH on 20 Apr 2022, 22:14, edited 1 time in total.

User avatar
wahine
Grumpy Cat
Posts: 3432
Joined: 01 Jul 2009, 07:58
FS Record: Your life does not get
better by chance, it gets
better by change. JR.
♀️

Re: FPL Team hacked - team name changed, players trf'd

Post by wahine »

Why? would anyone do that :evil:

User avatar
bigH
Treebeard
Posts: 267
Joined: 13 Oct 2005, 18:26
Location: Saxmundham, Suffolk
FS Record: FL Golf Major League Winner 2006

Re: FPL Team hacked - team name changed, players trf'd

Post by bigH »

I was using the free hit for this gameweek.

My squad for GW34 contains barely any of the players I had in my squad before I used the free hit.

User avatar
Smurphy Paw
FISO Knight
Posts: 14499
Joined: 17 Aug 2006, 17:48
FS Record: Mediocre, apparently
13/14: FPL 1792; FIFA 14 Top 700.
17/18: FPL 696th; loads of mini-League wins and side game promotions
18/19 1FC Köln 5AS Champions
#1 Spring Super League regular season 19/20 & 20/21

Re: FPL Team hacked - team name changed, players trf'd

Post by Smurphy Paw »

Sorry to hear this bigH. A few months ago hundreds of teams were hit. Do a Twitter search and you’ll see loads. FISO had issues too, for example:
viewtopic.php?t=134219

User avatar
bigH
Treebeard
Posts: 267
Joined: 13 Oct 2005, 18:26
Location: Saxmundham, Suffolk
FS Record: FL Golf Major League Winner 2006

Re: FPL Team hacked - team name changed, players trf'd

Post by bigH »

And to make it worse, whoever hacked my account has made 20 transfers, presumably costing me 80 points

All 20 transfers were processed at 18.20 on the 16th April

User avatar
bigH
Treebeard
Posts: 267
Joined: 13 Oct 2005, 18:26
Location: Saxmundham, Suffolk
FS Record: FL Golf Major League Winner 2006

Re: FPL Team hacked - team name changed, players trf'd

Post by bigH »

Thanks. I will have a look.

User avatar
Spreadsheet
FISOhead
Posts: 677
Joined: 19 Jul 2009, 17:36
Location: Leicester
FS Record: SDT Mini League Maestro - 5 wins and 3 Runners Up in 9 years. Never made it on the biggest stage though. I'm the DT David Bentley.

Only one FPL campaign (18/19) under my belt. Nothing spectacular.

Re: FPL Team hacked - team name changed, players trf'd

Post by Spreadsheet »

Mine was hacked too in GW24. They also made the max. 20 transfers (costing me 76 points after the FT) and then played BB to prevent me from using WC to reset my team, but also of course making me lose the power of a BB later on and with ‘proper’ players.

Changed my team name to the same as yours and also my gender (mature).

I understand that the max. 20 transfers per GW was brought in by FPL as a direct response to earlier hacks where THOUSANDS of transfers were being made on single teams and crushing their ORs, but of course the cap meant that I could not ‘accept’ more points hits for at least correcting my GW24 team so I had no choice but to leave it, as I guess you were left to do this week.

The ironic thing is I had been aware of the password hack issue and elected not to do anything as I thought I already had unique log in credentials for FPL, but clearly not as I must have used the same credentials on a poorly secured site somewhere else (not FISO I hasten to add as this is via different details). Apart from FISO, I’m not signed up to anything else FPL-related so thought I’d be safe but clearly not!

Log in credentials changed and no further hacks suffered but it’s killed my season.

Edit to add: gobbled up a lot of my TV to get the players back that I wanted, as I had to pay the higher prices and only got half the increases I’d baked in across the season before the hackers sold them. That’s still something that plagues me as my ML rivals easily have 1-2m more to play with.

batesv
Cheetah
Posts: 5
Joined: 16 Oct 2006, 20:05

Re: FPL Team hacked - team name changed, players trf'd

Post by batesv »

Just noticed mine was hacked on 24/4 04:51 am, 20 transfers done, shit squad in place & $17m in the bank…..terrific


Sent from my iPhone using Tapatalk

User avatar
Mav3rick
FISO Jedi Knight
Posts: 20858
Joined: 20 Jul 2009, 20:35
FS Record: FPL: 1082, 1201, 1800, 10203

The stats are dark and full of errors.

Re: FPL Team hacked - team name changed, players trf'd

Post by Mav3rick »

That's really awful batesv, I know FPL are intending to bring in some form of (optional?) MFA next season, and it really can't come soon enough.

User avatar
DamnedUtd
Wideboy
Posts: 71
Joined: 05 Aug 2010, 11:15

Re: FPL Team hacked - team name changed, players trf'd

Post by DamnedUtd »

Same for me too. “Credential stuffing” is the official term according to FPL, and they are doing jack about, frankly I’m considering jacking it in all together.

Poor security protocols in place for a platform that has ~5m users .

20 transfers done at no $ cost to me, achieved via a wildcard I shouldn’t have (I had used my last wildcard last week)

The hackers have hacked the platform and whilst jeopardising my team to a squad of no hopers, they could in theory hijack their own team And give themselves a free wildcard given what was achieved with my team above


Sent from my iPhone using Tapatalk

User avatar
ajcairns
Grumpy Old Man
Posts: 1237
Joined: 05 Oct 2016, 14:40
FS Record: Still Decidedly Average.

Re: FPL Team hacked - team name changed, players trf'd

Post by ajcairns »

DamnedUtd wrote: 29 Apr 2022, 23:18 Same for me too. “Credential stuffing” is the official term according to FPL, and they are doing jack about, frankly I’m considering jacking it in all together.

Poor security protocols in place for a platform that has ~5m users .

20 transfers done at no $ cost to me, achieved via a wildcard I shouldn’t have (I had used my last wildcard last week)

The hackers have hacked the platform and whilst jeopardising my team to a squad of no hopers, they could in theory hijack their own team And give themselves a free wildcard given what was achieved with my team above


Sent from my iPhone using Tapatalk
First I’ve heard of any actually breaking of the game. Yes there’s been credential stuffing but not actually hacking the game rules.

Your team link doesn’t reflect your comment so could you update it (or just post your team ID) so we can have a look?

User avatar
Mav3rick
FISO Jedi Knight
Posts: 20858
Joined: 20 Jul 2009, 20:35
FS Record: FPL: 1082, 1201, 1800, 10203

The stats are dark and full of errors.

Re: FPL Team hacked - team name changed, players trf'd

Post by Mav3rick »

DamnedUtd wrote: 29 Apr 2022, 23:18 Same for me too. “Credential stuffing” is the official term according to FPL
...
The hackers have hacked the platform
Yeah credential stuffing in the sense that passwords from other data breaches are being used to access FPL accounts.

It was the FFH hack that released most passwords it seems, as people often used the same password for both.

I've not seen any suspicion that the actual FPL platform has been hacked, and the defence against credential stuffing is MFA which they have said they will introduce next season.

It really sucks to have your account hacked under any circumstances and I'm really sorry it's happened to you, but it does serve as a warning to not share passwords between accounts, and to use (secure) password managers where possible.

User avatar
DamnedUtd
Wideboy
Posts: 71
Joined: 05 Aug 2010, 11:15

Re: FPL Team hacked - team name changed, players trf'd

Post by DamnedUtd »

ajcairns wrote:
DamnedUtd wrote: 29 Apr 2022, 23:18 Same for me too. “Credential stuffing” is the official term according to FPL, and they are doing jack about, frankly I’m considering jacking it in all together.

Poor security protocols in place for a platform that has ~5m users .

20 transfers done at no $ cost to me, achieved via a wildcard I shouldn’t have (I had used my last wildcard last week)

The hackers have hacked the platform and whilst jeopardising my team to a squad of no hopers, they could in theory hijack their own team And give themselves a free wildcard given what was achieved with my team above


Sent from my iPhone using Tapatalk
First I’ve heard of any actually breaking of the game. Yes there’s been credential stuffing but not actually hacking the game rules.

Your team link doesn’t reflect your comment so could you update it (or just post your team ID) so we can have a look?
Team ID is 239678


Sent from my iPhone using Tapatalk

User avatar
Sutter Kane
Dumbledore
Posts: 7522
Joined: 05 Aug 2010, 12:13
FS Record: Unknown.

Re: FPL Team hacked - team name changed, players trf'd

Post by Sutter Kane »

DamnedUtd wrote: 29 Apr 2022, 23:18 Same for me too. “Credential stuffing” is the official term according to FPL, and they are doing jack about, frankly I’m considering jacking it in all together.

Poor security protocols in place for a platform that has ~5m users .

20 transfers done at no $ cost to me, achieved via a wildcard I shouldn’t have (I had used my last wildcard last week)

The hackers have hacked the platform and whilst jeopardising my team to a squad of no hopers, they could in theory hijack their own team And give themselves a free wildcard given what was achieved with my team above


Sent from my iPhone using Tapatalk
When you say no cost to you, it looks like it has cost you 76 points, no third WC introduced...unless I am missing something??

User avatar
DamnedUtd
Wideboy
Posts: 71
Joined: 05 Aug 2010, 11:15

Re: FPL Team hacked - team name changed, players trf'd

Post by DamnedUtd »

I thought it was some kind of wildcard used but it’s 20 actual transfers, -76 points.

As there’s a 20 transfer cap I couldn’t even tap into the 17m in the bank to make any further transfers pre deadline

I genuinely thought the pick team view had a bug when I saw it mid week and decided I would re login and the bug would have been resolved.

Instead the face palm from FPL.

Shocking security for a platform with 9m users. Granted it’s not your banking app but still…


Sent from my iPhone using Tapatalk

User avatar
Magic
Grumpy Old Man
Posts: 2390
Joined: 16 Jul 2017, 08:29
FS Record: Improving

Re: FPL Team hacked - team name changed, players trf'd

Post by Magic »

Did you ever make any progress on getting this rectified?

I wonder whether people should be careful about posting links here to their FPL team because the people who're doing it might read FISO?

User avatar
Mav3rick
FISO Jedi Knight
Posts: 20858
Joined: 20 Jul 2009, 20:35
FS Record: FPL: 1082, 1201, 1800, 10203

The stats are dark and full of errors.

Re: FPL Team hacked - team name changed, players trf'd

Post by Mav3rick »

I think most, if not all, the hacks come from breaches on other sites which reveal an email and a password that are the same as the FPL account.

FPL links here should be fine (as the team id doesn't relate to the email address) although its probably a good idea to hide your email address in the "User control panel" part of your profile on FISO, especially if you use that email widely elsewhere:

Image

User avatar
DamnedUtd
Wideboy
Posts: 71
Joined: 05 Aug 2010, 11:15

Re: FPL Team hacked - team name changed, players trf'd

Post by DamnedUtd »

All I can say is my password was a unique password only used for FPL. My fiso password is completely different. Based on that fpl are culpable and have been totally dismissive in their interactions with me about accountability. Amateurs the lot of them. Garden shed game has developed into one of the largest gaming platforms and they are still operating garden shed security protocols


Sent from my iPhone using Tapatalk

User avatar
Magic
Grumpy Old Man
Posts: 2390
Joined: 16 Jul 2017, 08:29
FS Record: Improving

Re: FPL Team hacked - team name changed, players trf'd

Post by Magic »

Mav3rick wrote: 10 May 2022, 10:03I think most, if not all, the hacks come from breaches on other sites which reveal an email and a password that are the same as the FPL account.
But how would they know the person even has an FPL account unless they're familiar with a site that sort of gives it away by the posts and conversations therein?

User avatar
Magic
Grumpy Old Man
Posts: 2390
Joined: 16 Jul 2017, 08:29
FS Record: Improving

Re: FPL Team hacked - team name changed, players trf'd

Post by Magic »

DamnedUtd wrote: 17 May 2022, 04:36Based on that fpl are culpable and have been totally dismissive in their interactions with me about accountability. Amateurs the lot of them. Garden shed game has developed into one of the largest gaming platforms and they are still operating garden shed security protocols
Got to hope they improve security by next season. Less flashy price reveals and a bit more work securing the game wouldn't go amiss.

User avatar
Mav3rick
FISO Jedi Knight
Posts: 20858
Joined: 20 Jul 2009, 20:35
FS Record: FPL: 1082, 1201, 1800, 10203

The stats are dark and full of errors.

Re: FPL Team hacked - team name changed, players trf'd

Post by Mav3rick »

Magic wrote: 17 May 2022, 09:14
Mav3rick wrote: 10 May 2022, 10:03I think most, if not all, the hacks come from breaches on other sites which reveal an email and a password that are the same as the FPL account.
But how would they know the person even has an FPL account unless they're familiar with a site that sort of gives it away by the posts and conversations therein?
It likely starts the other way round, they want to get into *some* FPL accounts so they download a number of username/passwords revealed from other hacks (likely the FFHub one as that would have had the most cross over) and then just automatically try all the accounts. I don't think individuals are targeted in the main, not unless you're very famous in the FPL world in which case the same process applies, but they would be cherry picking specific usernames to try.

User avatar
Mav3rick
FISO Jedi Knight
Posts: 20858
Joined: 20 Jul 2009, 20:35
FS Record: FPL: 1082, 1201, 1800, 10203

The stats are dark and full of errors.

Re: FPL Team hacked - team name changed, players trf'd

Post by Mav3rick »

DamnedUtd wrote: 17 May 2022, 04:36 All I can say is my password was a unique password only used for FPL. My fiso password is completely different. Based on that fpl are culpable and have been totally dismissive in their interactions with me about accountability. Amateurs the lot of them. Garden shed game has developed into one of the largest gaming platforms and they are still operating garden shed security protocols
If you haven't done so already, have a look at https://haveibeenpwned.com/ and see what comes up for you.

View Latest: 1 Day View Your posts
Post Reply

Return to “Fantasy PremierLeague.com (FPL)”