Microsoft has confirmed that a number of Xbox Live accounts of their current and former employees have been compromised by attackers using "several stringed social engineering techniques", but has denied that it stores or in any way utilizes users' Social Security Numbers, The Verge reports.


The attacks have apparently been mounted by the same person(s) that have recently mounted a DDoS attack against the Krebs on Security website and sent a SWAT team to hit the site's owner Brian Krebs.

According to him, a hacker named Phobia and his gamer Team Hype have been angered by his writing about a website that sells access to people's private and financial information, which they regularly use to gather information that helps them hijack Xbox LIVE gamertags (online personas tied to Xbox Live game accounts) and sell them to other players.

The acquired SSNs are apparently used to social engineer phone companies into redirecting the calls made to the number belonging to the targeted individual to one of their own, then calling Xbox phone support to call the number and confirm it. With the one foot in the door, changing passwords for the accounts becomes easy.

Krebs also believes that the hackers behind this attack were the same ones behind the highly-publicized hack of a string of accounts of former Gizmodo and current Wired employee Mat Honan, and the recent DDoS attack that hit Ars Technica.