Nintendo: credential stuffing on Nintendo Network IDs led to logins on about 300,000 accounts

1. 2020-04-24

   Nintendo disclosed that since early April, IDs and passwords obtained outside Nintendo had been used to log into Nintendo Network IDs, and through them into Nintendo Accounts. The same day it removed the option to log into Nintendo Accounts with a Network ID. [1]

2. 2020-06-10

   Reports said later checks had found about 140,000 more accounts, for about 300,000 in total. [2]

Network ID nicknames, birth dates, countries and email addresses may have been seen. For linked Nintendo Accounts without two-step verification, names, birth dates, genders, countries and email addresses may also have been seen. [1] [2]

Nintendo said fraudulent purchases with account balances or saved cards may have hit under 1% of the accounts, and it refunded those users. [2]

Passwords of accounts that may have been entered were reset in turn, and users were urged to use different passwords for the two accounts and to turn on two-step verification. [1] [2]