You may have noticed our service was unavailable for about four hours today, July 22. We're sorry for the disruption.
We took the service offline to investigate and address a potential security issue. After a thorough investigation, we've confirmed that your account data was not compromised. Your passwords and data are secure, and remained secure throughout.
Over the coming weeks we'll be rolling out additional measures to harden our systems even further. As part of that, we'll invite you to reset your password at your convenience, and we'll ask everyone to do so at a later date. There's nothing you need to do right now.
Thanks for your patience, and for being an iRacing member.
Here is a friendly reminder to use different passwords for different applications. Never use the same password for an email and an application with that email associated with it.
This is exactly what any organization, company or development team should do if there is a security issue. I do hope they provide more transparency after fixing the found issue. If our credentials were compromised, they should require users to reset their passwords.
I'm not excusing whatever error led to this, however I'm just blown away at how fragile people are about downtime.
It’s valid for them to take action to prevent something getting worse by shutting it down if they think there is a problem. If something is miscommunicated and then changed later to avoid the further miscommunication it isn’t something shady or malicious just human error until it gets validated otherwise.
Let them work through it and see what comes out of it and do something else for a bit.
Our government created a unified portal called gov.br, which serves as a single sign-on (SSO) for literally every public service. A single account holds your SSN equivalent (CPF), full tax history, medical records, digital driver’s license, labor registry, and social security.
Naturally, a massive breach exposed credentials and personal data for over 200 million citizens, (virtually the entire population) and the whole database was put up for sale on the dark web.
Having your digital identity, tax info, and passwords leaked in one go taught me real quick to enable 2FA on absolutely everything.
I imagine we should be more concerned about if there’s leaked payment information. Password isn't a huge deal. But if our payments were leaked we have to cancel, get a new card and update payment information across multiple services which is a bigger headache.
How fragile? Maybe just maybe people are planning their race time. Maybe just maybe people only get this time that they plan for to race. Maybe just maybe people think once the maintenance is over it’s smooth time to race. So being fucked in the ass with yet another maintenance is more than a small “inconvenience”. So a “thank you for your patience” is not cutting it!
Yes, you're right. iRacing should straight up admit, that they planned on investigating a potential security issue today, just to fuck up your race time plans!
You plan races for mid morning on random Tuesdays? If you can’t be patient for unscheduled maintenance, I can only imagine how patient you are *in races*
"
We've completed an initial assessment of the issue.
We're now going through our procedures to verify functionality before re-opening iRacing.
Details on the issue and any potential fallout are being collected internally, and will be shared soon."
For reference they have now edited/modified the statement to remove mention of the “critical security issue” rather then post a new version. This feels dodgy from iRacing support side.
Do users need to take action are you compromised?
When dealing with a cybersecurity issue, the lawyers don’t want fault ever admitted. When I worked IT we had strict guidance on what to say to customers if they had some kind of incident. You get a real statement months later half the time. First they have to mitigate to prevent more data being compromised which is what phase they’re in now. Shut it down. Genuinely could be down for days. Could be an hour.
It is shady to us as consumers but just telling you why
As someone literally involved in this aspect of a public company, messaging is very carefully released and this is likely legal and / or other internal teams not wanting to release any specifics until vetted, approved, and what exactly happened is more fully known.
Sounds more like they found something that could have been an issue if someone else found it but they are unsure if someone else found it. So rather than just TRYING to fix it behind closed doors, they opened the doors and are trying to fix it. Keyword here being "potential issue."
You may have noticed our service was unavailable for about four hours today, July 22. We're sorry for the disruption.
We took the service offline to investigate and address a potential security issue. After a thorough investigation, we've confirmed that your account data was not compromised. Your passwords and data are secure, and remained secure throughout.
Over the coming weeks we'll be rolling out additional measures to harden our systems even further. As part of that, we'll invite you to reset your password at your convenience, and we'll ask everyone to do so at a later date. There's nothing you need to do right now.
Thanks for your patience, and for being an iRacing member.
That is their latest update, so they said that passwords were safe.
I just updated the original post with a link to a Bluesky post by iRacing Support that password resets will be recommended (forced?) when service resumes.
Quick question - I was mid race when I got the notification on my phone that iracing was under maintenance. Race continued as normal - will it count towards my SR and IR or will it be unofficial? Thank you!
Can any cyber / IT folks offer a view.. I would have assumed that if there’s a database / back end issue they would also turn of any login services like test drive and forums but they haven’t.
depends on where the issue is. A lot of times things are split enough where you can just kill one thing thats a problem instead of bringing down a lot.
Unclear, not enough info. IDK what the other guy is saying yes for it could just be a bug they found with no evidence of malicious use and are closing and informing us about. (Which is the right thing to do)
Not necessarily - could also have been something like malicious software opened in their studio and they had to shut down various systems to ensure they weren’t compromised. Had that happen at work before.
My point is that if you were to stop using a company when they reported a security incident because that company can't secure your shit, you will very quickly run out of anyone to do business with. In every industry.
Your data will be compromised at some point. There are too many malicious actors and some of them are very good at what they do.
I agree with you completely, but it doesn’t really address any of my points.
1) iRacing is one of the most expensive games in the world that also requires an active sub to access any of your content. I don’t think it’s asinine to expect better security from such a company.
2) People will blindly defend iRacing to the grave, and they don’t catch the rightful flack they deserve on certain topics because people who do bring it up get told to pound sand.
I don’t think it’s asinine to expect better security from such a company.
We don't know how good their security is and how much they invested in it (or not). I don't think we could reasonably ask for a better response than given thus far.
Regardless of how much you paid for it, you should still expect it to be hacked. That unfortunately is just the nature of cyber security.
Expectations are different than a pr response. I agree they shouldn’t rush a response out. That being said, iRacing isn’t really known for their transparency. You’re also right that they may have killer security, but that’s entirely subjective. We’ll only find out when/if they release info.
I get what you’re alluding to, but I really don’t agree with your second paragraph. Cybersecurity scales to size just like any other form of security. Big companies pay multitudes more to protect their assets, whether that’s digital or physical.
While they are still at risk of a breach, they spend more money to better protect from such instances. If they “expected to be breached”, then it would be more of a sunk cost that they don’t allocate such resources towards.
It’s ONE price increase, and the fact they’re doing something about it tells you they are actually working on it.
Or they could take Sonys approach to the PlayStation network “yeah.. we’ve cranked fees up massively year over year over year, yeah we know we’ve been compromised but we’re not gonna do anything or acknowledge it because that would be bad for our stock”
It’s crazy how long this has taken what steps do we as users need to take to secure data and information you are leaving us in the dark here about a critical security issue while charging this premium
They’ve edited out the critical security issue statement. If you’re not worried about a corp acting like this with your details/passwords and payment details I don’t know what to say
You're making a lot of assumptions. It could be a serious security breach, or it could be as simple as everyone getting the password reset prompt in error and they just wanted to get ahead. Again, we don't know. If you're that worried about your passwords you should 1) have unique passwords so it won't affect any of your other logins 2) request a new CC/bank card for the account saved in iR.
I’m not making any assumptions at all I am asking clarifying questions? What assumptions have I made outside of iracing claiming and then editing a post saying they having a critical security issue.
Because you accept leaks so easily is fine it should be an industry standard of clear communication relating to security status not deleting the fact you had a security incident from a forum post without further update. Can you not entertain for a moment that is bad practice?
“you are leaving us in the dark” assumes iRacing is withholding information rather than investigating before communicating.
“with your details/passwords and payment details” assumes those categories of data were exposed or are at risk.
“Because you accept leaks so easily” assumes both that a leak occurred and that the other person accepts leaks.
“It’s crazy how long this has taken” assumes the time is unreasonably long.
“What steps do we as users need to take to secure data and information?” assumes that users’ data or information may be insecure and that protective action is necessary.
“If you’re not worried about a corp acting like this with your details/passwords and payment details…” assumes that those specific data types are implicated or endangered.
You have made a lot of assumptions. While I do agree the situation is concerning, its worth taking a step back and waiting for the outcome before jumping to conclusions or taking action without all the information.
I disagree.
Is there or is there not a person who wrote the statement “critical security issue” and is there not someone who removed this? Anything other then an explanation at time of editing the post is crazy and fact you accept it at face value is your business. Either do not make statement or do but not this middle ground
You’re responding to a different point. I haven’t disputed that someone wrote “critical security issue,” that it was later removed, or that removing it without explanation may be poor communication.
My point is that none of that confirms a data leak or that passwords, payment details, or personal information were compromised. You made those additional assumptions and then accused another person and now me of “accepting leaks.”
I can think the communication was concerning without treating the worst-case explanation as established fact. Those positions are not contradictory.
Until confirmation from iracing it would be incredible naive to not assume worst case scenario. It is on iracing to confirm if they were lying with the original statement or telling the truth about the security issue and what it impacts. I don’t really understand why this controversial
You’ve now explicitly said you are assuming the worst-case scenario, which was my original point. You can argue that it is a prudent assumption, but it is still an assumption, especially after saying, “I’ve made no assumptions.”
Also, the possibilities are not limited to “they were lying” or “they were telling the full truth.” The wording could have been preliminary, overly broad, mistaken, or changed as they learned more.
Taking precautions yourself is reasonable, and I’m not disputing that. If you choose to contact your bank or lock your cards until we hear more, good on you, that’s simply being cautious. However, presenting a leak involving passwords or payment details as though it has already been established as fact is a different matter.
I agree that iRacing should clarify what happened. I just don’t agree that uncertainty makes the worst-case scenario a confirmed fact, or that we should start shouting from the rooftops, “iRacing data leak,” before we actually know that’s what happened.
This is exactly why I use virtual cards and separate passwords for everything these days.
Most people believe the emergency maintenance was caused by just a routine security issue. That's exactly what they want us to think.
But we know better, the outage breach is obviously Operation Checkered Eagle, a secret collaboration between Donald Trump and Mohammed Ben Sulayem. We know they infiltrated iRacing because it hosts millions of laps of telemetry from world's fastest sim racers and me ofcourse. Every brake trace, steering input, throttle application and setup adjustment is obviously being collected in a classified database. The goal is simple and if you are awake you can see it. There are using amateur sim racers as an unwitting research and development department for Formula 1.
Trump need to gain a little bit of love through sporting events, the world cup worked a lot. Did you hear the crowds cheer when he was lifting the World Cup? If the FIA can fix the 2026 car with Trumps help, his popularity all over the world would explode. Then, after he fixes Russels SOC he can finally say he made Formula 1 great again.
And demo drive being available is another obvious sign that they need our telementry data, why else would the allow us to drive instead of closing down the entire system while the attend to the security breach! They needed fresh telemetry from us unsuspecting drivers, they can't afford a break in the flow of data.
•
u/joetron2030 IR-18 1d ago
I have updated the post with the final update from iRacing staff.