Following up on an earlier report, Nintendo has confirmed that a limited number of Nintendo Accounts have been compromised via "hacking" attempts. Nintendo is currently disabling the ability to log into Nintendo Accounts through the use of the Nintendo Network ID (NNID) after they discovered that about 160,000 accounts were accessed by outside parties. Nintendo said that the IDs and passwords used were obtained outside of Nintendo and have been used since the beginning of April to gain access to various Nintendo Accounts.
This means that the account information that is being used was from data breaches that came from other sites or services that were hacked in the past. The issue isn't with Nintendo at all. People just used the same login information at Nintendo as they did at sites that were hacked in the past. This is a textbook reason why you shouldn't use the same password at more than one location!
As we have suggested a number of times before, it's incredibly easy to set up and use something like a password manager that can securely store and create unique passwords for you. At most, all you will need to remember is just one master password. Just like Nintendo, we also strongly suggest that you enable 2FA on your Nintendo account and any other account that gives you the option of enabling 2FA. It may be an extra step needed when you log into an account, but it's far less time than having to deal with trying to retrieve your account or get refunds for erroneous purchases made by outside parties.
The accounts that were accessed in this way allowed the intruders to see information such as nicknames, dates of birth, country, and email addresses. Accounts that had payment methods tied to them also included various amounts of fraudulent purchases.
In response to this, Nintendo is again suggesting that users enable two-factor authentication (2FA). The company is also actively resetting passwords for accounts that they believe were compromised. If you used a NNID to log into a main Nintendo Account, this method has been disabled by Nintendo. The NNID was previously the primary method to log into accounts on both the 3DS and Wii U. Since the Nintendo Switch came out, Nintendo has used a newer system. However, this new system was able to be linked to the old NNID (until today), which is the reason we're even talking about this in the first place.
Emails have also been sent out to the users that Nintendo believes were impacted by this. If you believe you were one of those 160,000 people impacted by this, be sure to check the activity on your account and report any suspect purchases to Nintendo.
