Reset all passwords

[dindyemakom]

This shit with mannequin isnt funny anymore, just reset all passwords.

[Brilliand]

"Everyone who hasn't changed their password since the breach can't log in until they do" sounds like a good rule to me.

Though, if it was that easy, I think the devs would have already done it. I'm guessing there's something making it hard to do that with 100% accuracy?

(Just to speculate: there might be a large number of accounts with throwaway emails that have had their passwords changed by Mannequin.)

[Yemac]

It's not that hard, but what makes BMG hesitate to do it is that a lot of people will lose their accounts since they didn't have an e-mail with their account yet. There is no going back from resetting passwords.

[Brilliand]

It's not that hard, but what makes BMG hesitate to do it is that a lot of people will lose their accounts since they didn't have an e-mail with their account yet. There is no going back from resetting passwords.

There are other ways for people to prove they own the account, once they discover that they're locked out.

Players who paid for something in-game can provide the details of that previous purchase (including CC numbers for example) to prove that they paid for it.

Players with grandfathered free accounts still aren't completely out of luck - they can provide a password that matches one of the past passwords on the account, from an IP address that had logged into that account on many previous occasions. (This requires that the reset passwords be backed up somewhere, rather than deleted entirely.)

Runescape's account recovery system provides ideas for several other methods, such as asking the player to reminisce about things that happened while they were using their account.

These verification methods are a bit labor-intensive, but I kinda doubt that BMG will face an unmanageable flood of support requests.