Your Xbox Live email could have been exposed to hackers

A recently-stock-still vulnerability could accept exposed a role player'sXbox Alive e-mail to hackers through their Gamertag, potentially compromising the online service used for Xbox One and Xbox Serial X|Southward multiplayer gameplay and social features.

Xbox Live has been around for most twenty years, outset with the original Xbox panel. The service has seen changes over the years such equally the ways a thespian tin can create a Gamertag and its eventual inclusion equally office of Xbox Game Pass Ultimate. It has since been discovered that a security vulnerability could accept exposed a player's email to hackers without too much effort.

Why the Xbox Live e-mail vulnerability is a problem for players

The Xbox Live email vulnerability was reported to Vice via two ethical hackers who had wanted to alert Microsoft about the consequence. That bearding hacker asked Vice not to publish anything until Microsoft had confirmed the issue was fixed for one unproblematic reason: it wasn't too hard to discover the vulnerability.

"If you lot publish the article before it'southward patched it will get found within 2-three minutes," i of the hackers told Vice. "Information technology'due south the easiest vulnerability I've ever institute."

According to the hacker, the email addresses were accessed via the Xbox Alive Enforcement website. The technical issue allowed anyone with the proper knowledge to discover the email address behind whatever Gamertag within a few minutes. Vice's own testing showed that the technique worked, although Microsoft has since deployed a ready to correct the problem.

This isn't the showtime time this yr a player's personal information wasn't adequately protected, either — it was recently discovered that aGenshin Bear on issue could take exposed the telephone numbers of some players. Thankfully, this particular issue was as well quickly resolved pastGenshin Impact's programmer Mihoyo.

The exposure of a role player's Xbox Alive email address on its own wouldn't result in an account being compromised, merely it could accept led to online harassment — or more worryingly, phishing attacks. For case, fakeCyberpunk 2077 beta invites went out before this twelvemonth, presumably in an attempt to steal players' personal data. Nobody knows for sure how long this vulnerability existed in Microsoft'southward systems, and so players using Xbox Live should pay extra special attention to whatever emails purporting to be from Microsoft in the future.