160,000 Nintendo Accounts Were Compromised

Throughout the month of April, and particularly this weekend, users of online Nintendo accounts on devices like the Switch have reported receiving email notices that their accounts have been accessed by outside parties. Our ability to verify these claims was bolstered by an unfortunate intrusion on Monday: the hijacking of an Ars Technica staffer’s account.

Roughly one hour before this article’s publication, Reviews Editor Ron Amadeo received a plain-text email notice from Nintendo, titled simply, “[Nintendo Account] New Sign-In.” The notice included the following sign-in details: a 5:25pm ET timestamp; the sign-in taking place via the Firefox browser (which Amadeo says “is not even installed” on any devices he used today), and a location estimate of “United States,” which the email says is “estimated based on the IP address used.” IP addresses generally pin users down to the county level when traced in the United States, and they are often as specific as individual cities or states.

The email caught Amadeo’s attention in part because all of his Nintendo devices are, in his words, “collecting dust.” Our cursory research for other affected users brought up threads on Reddit, Twitter, and ResetERA. One Twitter thread included a questionnaire with questions about possible account variables: whether users had logged in to the service via a website (which Amadeo had not), whether users had tied their Epic Games or Fortnite credentials to the service (Amadeo had not), and other questions. He did answer “yes” to one question, which over 90 percent of respondents had, as well: use of the Nintendo Network ID service. (Amadeo had used this for Nintendo’s previous home console, the Wii U.)

Nintendo did not immediately respond to Ars Technica’s questions about the source of the breach or about what credentials and personal details may have been accessed by intruders. Thus, we are unsure whether unauthorized logins are thanks to leaked passwords or what other personal details may have leaked (including email addresses, home addresses, phone numbers, usernames, credit cards, or PayPal account information).

In the meantime, we strongly urge anyone who has ever used an online Nintendo service to log in to Nintendo’s accounts portal in order to change their passwords, unlink payment credentials, and enable two-factor authentication (2FA). All of these steps can be conducted at the “security” sub-page, whose URL is https://accounts.nintendo.com/security. This also includes a convenient “sign-in history” page. (After logging in to his account to do all of the above, Amadeo said he couldn’t recall whether he’d used his Nintendo account password elsewhere but that he believed it was unique.)

It’s not like an attacker could do anything to me, though, right?

Even if this intrusion is incredibly limited, users should be careful.

Amadeo reported this intrusion with a shoulder shrug, noting that the credit card attached to his account was already expired. “What can [a hijacker] even do? Even if there’s a valid credit card, I don’t think you could register a new Switch to my account and start buying games.” This assumption is fueled, in part, by Nintendo’s draconian stance on putting a single account’s credentials onto multiple consoles.

Enlarge / Google’s automatic translation of the “how to buy” instructions at the Brazilian Nintendo eShop. The game in the background, Panzer Dragoon: Remake, costs roughly $21 in US currency.