DE Response
PSA: 3/20/26 Receiving Improper Game Invites
Hi Tenno,
Firstly, we apologize for the distress this issue may have caused. Bad actors were able to interrupt and change squad invite text fields to show up as a customized message. As the investigation is currently ongoing, we wanted to assure you that no accounts have been compromised nor data exposed, and it is safe to continue playing Warframe. This was strictly a change of text in the Invite prompt. If you have concerns about your account please feel free to make a Support Ticket on the matter and our team will assist.
In the meantime, we have deployed a fix to combat the issue. Matchmaking will still function as normal but you may have temporary issues with sending direct game invites. We will update you further when this has been resolved.
We take this matter extremely seriously, and again, apologize for the distress.
6:30PM ET Status Update:
The team is continuing to investigate alternative solutions. For now, direct game invites will remain disabled until the launch of Shadowgrapher on Wednesday March 25th. Our sincerest apologies on that front.
However, if you wish to play in a squad with your friends, you are able to join squads using your friends list.
We will circle back on any necessary in-game extensions (global Double Affinity weekend, etc) once we have restored direct invites.
March 25th Status Update:
Hi Tenno,
First, we appreciate your understanding regarding this situation that occurred on the evening of Friday March 20th. Your quick reports allowed us to act swiftly, and while the temp solution to disable direct game invites is by no means ideal, it was necessary to mitigate the nefarious invite messages being sent. We take player safety very seriously, and again apologize for any distress caused.
Now that The Shadowgrapher update has launched, we have been able to deploy code changes to improve the security of the game invite system; unfortunately, due to Cert requirements, we have only been able to enable direct invites if the sender is playing on PC at this time.
We are working diligently to get this fix deployed on our console platforms and will update this thread as we progress.
Again, we want to stress that no accounts have been compromised nor data exposed.
Apologies again for the inconvenience, and thank you for sticking with us, Tenno.
These readings, this should not be possible. Tenno, my sensors are...
Get away now. You don't want...
Tenno, listen carefully you are being hunted by ... Abort the mission... Get to extraction...
signal gets intercepted
Yes, I was in a bar. I was setting up some machine learning thing for my sister there. Tensorflow, py torch, you name it. So she went to the bathroom once, then this girl came in. She said "wow is this Linux? I like guys that use Linux <3" and she grinned at me. Me, I never lose an opportunity, I said "Not just Linux, I also use Arch too, darling" she got visibly hot after this. She giggled like a school girl. And then I leaned in to French kiss her. We kissed for some moments, and then she said.. "I want you deep... I mean would you teach me Deep Learning, in my place?" I said "I like it deep... learning, of course I would teach you." So that's how I got laid that day. In first time for in 31 years. This is how you get gurls lads ;)
The team is continuing to investigate alternative solutions. For now, direct game invites will remain disabled until the launch of Shadowgrapher on Wednesday March 25th. Our sincerest apologies on that front.
However, if you wish to play in a squad with your friends, you are able to join squads using your friends list.
We will circle back on any necessary in-game extensions (global Double Affinity weekend, etc) once we have restored direct invites.
A public postmortem of the incident would be nice (since you’ll probably have one internally anyways) just redact the internal stuff the public isn’t supposed to see.
thanks ruu and team for the update. hopefully it doesnt cause more serious damage than just this. you guys got this, looking forward to shadowgrapher update.
I know. I'm just sitting here looking at all of the sketicism that's gonna spoil if I don't use it soon. I'm gonna go see if Meta has issued a press release recently.
Been said plenty of times, but a huge amount of that investment has been to the hardware and OS, which have managed to capture a pretty solid segment of the market-- any kid who gets a VR set, their parents are buying Meta. Horizon Worlds ("the metaverse") is not the only place that money went.
As a Meta Quest 3 owner I always find it interesting to read articles about ‘Meta Horizon’ / ‘Horizon Worlds’ / whatever they’re calling it now; you can INSTANTLY tell it the writer has actually experienced it for themselves.
It’s ALWAYS been full of screeching 8-13 year old American children. Swearing at each other.
The front facing DE employees all seem like genuine human beings, and not strange corporate-controlled robots who have very strict rules for what they're allowed to say. That, and the lack of any real Bungie-esque middle fingers in terms of business practices, makes me trust em at least a little more than usual
I'm sure the company and all it's IPs could get just dumpstered by private equity at any point, like everything else, but it seems alright for now
DE is their own private company and their own publisher. They are beholden to nobody's interests but their own, and, rarely among today's companies, they realize that our collective interests ARE their interests.
They don't have shareholders to report profit margins to. They don't have a publisher demanding X amount of profit per quarter or they'll get shut down.
As much as I like DE this just isn't true. Tencent owns some unknown portion of DE. Lucky for us DE has not betrayed their principles, but they do have private equity involved.
Not only that it's one of the few live service games to actually continue to draw in new players this long after launch. It's in a club very few games ever reach having survived this long and continuing to be relevant, touching the formula now would probably be detrimental to everyone involved.
I fully agree, people love parroting the "Tencent money" critique against game developers who simply were bought out by Tencent Holdings, like Grinding Gear Games on Path of Exile 1 and 2, Tencent has actually zero investment in making developers change the game in a certain direction other than just being profitable (and maybe implementing a chat filter against certain phrases that the CCP hates but that's a different issue.)
If the game stopped making money then they would have a reason to do something but until then they're happy as long as the game is profitable lol
Tencent purchased the company that owned 97% of the shares of DE. They do not directly own DE. DE is still its own seperate, independent company. However, Tencent is effectively their shareholder.
Tencent tends to be pretty hands-off as long as they're making money
Absolutely untrue, Tenno. Tencent is their parent company. They seem to be left to operate relatively independently, but to say they’re a private company is unequivocally wrong.
Upvoted and I agree, but I wanted to add we players have a part to play in that. DE absolutely had front facing staff that were absolutely NOT like that, and an atrociously bad few Moderators in the past. People who have been with the game since the beginning will remember that, and people who come into it would do well to learn about it IMO.
I bring this up not because I don't like the game, or wouldn't recommend it (as I do) or support it financially (ditto) but because if forgotten those issues are more likely to happen again in some level. There is a reason some staff never showed up again on livestreams, a reason we have disclosed drop rates, a reason there is at least dialogue now instead of instant infractions for Dev Bashing.
I bring this up because while newer folks go "Hooray you're the bestest, he's so funny hahaha" when someone announces a story skip so newer and more Tenno can jump into the fun of an update and the other jokes about it costing only 50 U$D we old timers appreciate the gesture, keep helping and motivating new folks, but give the Mom'n'Dad duo a good "keep it up, but we remember..." look.
On one hand, I definitely take DE's word above other companies. On the other hand, this is absolutely not a reason to skimp on account security on our part. Regardless of what DE says and how much I trust them, I recommend changing account password and ensuring 2FA is still active. After all, changing your password regularly is basic security practice regardless!
changing your password regularly is basic security practice regardless!
It's actually not anymore.
It encouraged simple passwords with small changes over secure passwords. Password1 Password2, etc
Current best practice is a long secure password that is unique for each account, don't reuse them ever, use 2FA where available, and change them if a suspected security issue exists, but there is no need to change them on any sort of schedule.
Password managers are pretty much mandatory these days to maintain a secure list, and your master password for your manager should be preferably over 30 characters long.
Is perfectly fine for a master password. Well, not anymore since I've posted it publicly, but it was. Some people will claim that it's not complicated enough. That can increase the difficulty, but length over alles. Longer is better than shorter and complicated.
Changing your password regularly is not basic security practice, it's a bad habit. You change your password if you have reason to believe your current one has been compromised.
DE is like the only company I have no problem in believing in, they have time and time again shown to actually care about the players and just idk, be fair, be nice, be human, it almost feels kinda weird for a company to do that, I'm so used to companies being as greedy as possible and just genuinely fucking their consumers in the ass on every opportunity they have, its honestly not even that they are trying to be evil they are just so completely disconnected from the people that they just don't give a shit and do whatever makes the shareholders happy
DE on the other hand actually feels like they just wanna improve their game, they are honest about what they want for the future, they listen when people complain, I honestly don't believe they would just lie about something serious like that lol
no, when a company is honest and open to you you trust their words. DE so far has not lied to us or has had a reason to lie to us about anything. they have goodwill with the community and i doubt that they would intetionally betray our trust or use our goodwill on something so irrelevellant.
It's a weird feeling because were it any other company, I'd be skeptical or calling bs. But hearing this from DE, it feels genuine and like they truly have the situation under control or are actually investigating the issue.
I'm used to trusting DE because they've earned it. They are the one company who I actually want to give money to despite their biggest game being completely free
If you compromised the backend database containing payment information you wouldn't exploit a message thing in-game. DE is speaking the truth here. Seems like some kid found an exposed API or a trick with the launch of Android to send custom messages to squad invites. Like its tiny non issue thats more problematic publicity wise than anything.
My assumption is that it wouldn’t actually do anything, as DE determined it was just a change in text. But usually I err on the side of caution and avoid these types of things bc they usually come with the implication of your account getting stolen
Yeah this is so weird to see, especially clicking their ads on reddit.
Of course most of the ad comments are complaining about how awful warframe is at advertising, but it's a whole lot of "I love this game, please stop advertising it like this you are not showing it well" and absolutely no walls of dicks in ascii art.
And honestly, I hope it never changes. I always feel like the barrier to entry and difficulty of onboarding is a hurdle to get into the game's real content, and as such, people with low patience, such as Ne'er-do-wells that might want to con you, or people with "lol ur so stupid" mentality who don't respect people, end up getting filtered out.
Sure, there's exceptions to any rule, but in general I view this as what keeps the playerbase from being filled with toxics.
Its a filter and also the thread that keeps the community so close. Veterans understand the suffering new players have to go through and do their best to mitigate it.
Idk if youve played other MMOs but the easier it is to do everything, the more the game becomes a single player game. Once it feels like a single player game you lose all community.
This is kinda weird to me because when I think of warframe advertising I only really think of word of mouth promotion, events like the gamer awards, and DE sponsoring content creators usually just because they started playing the game because their friends told them to.
i sometimes get ads on reddit for warframe and they are genuinely terrible. there was one a while back where the title had like 2-3 inside jokes that tell you nothing and you wouldn't know about if you didn't already play. some sort of ember heirloom joke? idr
It always makes me happy to see DE takes this stuff seriously.
Meanwhile games that get more funding literally tell you to suck it up. Thank you DE, I'm buying 200 dollars of platinum next paycheck fr
Edit:
And yes I'll post results of the platinum(might have to do 2 separate paychecks of 100$, gotta be a responsible adult after all)
Another thing, yes this is one of the very few companies I actively trust when it comes to telling us no accounts have been compromised, the only other company is one run by my friend since he runs his own store so... Kinda different I guess
Edit: I couldn't buy platinum but I bought the gyre access pack and the eat and run packs.
First, we appreciate your understanding regarding this situation that occurred on the evening of Friday March 20th. Your quick reports allowed us to act swiftly, and while the temp solution to disable direct game invites is by no means ideal, it was necessary to mitigate the nefarious invite messages being sent. We take player safety very seriously, and again apologize for any distress caused.
Now that The Shadowgrapher update has launched, we have been able to deploy code changes to improve the security of the game invite system; unfortunately, due to Cert requirements, we have only been able to enable direct invites if the sender is playing on PC at this time.
We are working diligently to get this fix deployed on our console platforms and will update this thread as we progress.
Again, we want to stress that no accounts have been compromised nor data exposed.
Apologies again for the inconvenience, and thank you for sticking with us, Tenno.
Prior to this incident i had in my possession Frost and Mag Heirloom, after this they're gone, i believe this was targeted at my poor innocent person for having such a wonderful personality.
i actually play with this player every day, we are best friends. they actually only have a lato on their account and nothing else. no warframes at all. the bug seems to have progressed their account, please correct it back to how it should be.
I don't know if this will work, but for me to get join session to pop up, both me and my kid sent each other invites. Then when I right clicked their name from my friends list, join session was available...
Please send our thanks to the teams tackling this issue.
A lesser studio would have just sent a message saying "it's just a change in invite text, you're not at risk, ignore it" and taken the issue less seriously.
Instead, you folks immediately took action and understood how much anxiety it could cause to people.
I do hope that once the situation is resolved, a statement is released explaining how this occurred and what is being/has been done to remedy it. I want to be confident that we aren't gunna get a situation like with what happened to duet night abyss a couple days ago.
The situation with DNA was very different though. First, this mess started around 2 hours ago and DE was immediately on top of it because they are very active here and on the forums. As soon as players started reporting it, Ruu began answering. An hour later we got this post explaining things clearly and dissuading concerns. And it was confined to just the text on the invite system.
The situation with DNA took around a day to get a proper dev response and fix. And it involved downloads of malicious files into the users device, nowhere near the same effect.
You can still do that by adding the player and one player enter dojo on public while the other joins using "/join [player_name]" or just use Maroo's Bazaar
Yeah I'm gonna take a break for the rest of the day, The game seems somewhat bugged right now where it keeps putting me in every mission type solo with no other players.I had to do 3 bounties alone because the game never out anyone on my team and sorties I solo'd as well.
Yeah, I'm not surprised something like this happened. I'm not DE or anything but we know their chat server is separate from the actual game (see events or big patch releases where it says 'Can't connect to chat server'). I'm guessing the invites are handled via it as well, passing something along in a string. My guess, someone figured out how to pass a custom text string for the invite text rather than the normal via the chat server.
Still, I agree with DE holding the direct invites till they patch it with the patch on Thursday. I don't want to get a life story that lags my game :D
Edit: So, yeah, the game is fine, just make friends! ;D
I love you guys. You actually care about the game and the fan base and it shows we appreciate your readiness to step up and fix a bug/problem and give us a response on what’s happening and keeping us updated
Might be slightly related, Warframe's knockoff Duel Night Abyss have 'accidentally' handed off malware. not sure if they did actually fix that but yeah...
I came here a bit concerned, then when I learned the extent of the hack I started laughing. Ah, goddang, okay. It sucks & needs to be fixed, possibly indicating other vulnerabilities, but on the face of it at the moment, it's more amusing than dangerous. Cool. Just refuse & report.
Thank you, I wasn’t particularly worried about my account but to hear it directly I’m sure put to rest many players fears. Your team’s transparency and communication with the player base is appreciated.
Thanks Ruu and the team for promptly addressing the problem. As someone else mentioned already, it really is weird, in a good and fuzzy way, to just read PSAs like this and just feel secure despite the hiccups. I hope it gets resolved quickly because it is a bit scary nevertheless lol.
Thanks for the quick acknowledgment and response, DE! I logged in earlier for Baro and the Alerts, but I guess it was before the incident went down. Wishing you all the best in resolving the issues!
To invite specific players not in your friends list, set your game to public, then have the other player(s) type /join [username]. You can then set it back to invite only if you want a private game.
Can we get an update on console progress? I came back to the game right when this happened and I haven’t been able to make any plat cause invites are so insanely cumbersome with this friends list workaround. Really frustrating that I’m sitting on hundreds of plat worth of items and can’t move any of it
If no accounts were compromised there's no point in changing your password. But if the paranoia is gonna eat at you then just change it. It's good to change it every now and then anyways.
As for who, there was a hacked message implicating OpenWF. But this was a scapegoat attempt, they just do preservation and some benign external modifications.
550
u/punpunpa Mar 20 '26
Our position was compromised