OK, so this sucks but here goes. To cut a long story short, I'm having to delete Wolf and Aaron for cheating.
The long story:
Back in October 2015 when I started converting the site to a mobile site, Aaron helped me out and converted maybe 30 odd pages of the 200ish pages. I gave him a folder in FTP so he could check the pages were working properly. He was someone I'd talked to plenty of times, had him on Skype, he lives in the same city as me and actually works less than a mile away from my house, so I trusted him with that access. There was nothing important in that folder so I didn't really give it much of a second thought and actually forgot all about it. Since then, I'd talked to Aaron plenty more, have written an article for his fightplatform site, which he gave me admin access to etc..
However, a couple of weeks ago, some guys from the game came to me and pointed out that Wolf and Aaron had some very weird stuff going on in their gyms. Their fighters didn't appear to be training, yet were high skilled. So I checked it out and it was indeed fishy - they'd edited their fighters somehow to be far better than they should have been (including hiddens) but I didn't know how. As I say, I'd totally forgotten that I'd ever given him FTP at this point (this year's been pretty hectic with my first kid, getting married etc... turns out that stuff makes you pretty forgetful).
So anyway, me and my programmer (and also people helping from the game) spent a couple of weeks trying to figure it out, programming in checks etc under the assumption it was SQL injection, access to an admin panel or through the forums maybe (hence the arcade disappearing, if you noticed that). It would have been nice to just ask straight up but we couldn't really risk that in case they did anything dodgy... I mean, we thought they were pretty sound people who were just fucking around and not doing anything malicious but you never know.
So after programming a load of checks, we couldn't figure out what they were doing, so I just asked Wolf straight up yesterday and he fessed up straight away. I'm grateful for that, cos he could have been a dick about it and played dumb or given a false lead. Instead he apologised and told me straight away. It wasn't a total waste of time doing all those checks because it's useful to have them in place anyway.
To explain what they actually did - basically nothing existing on the site was compromised, Aaron just wrote his own script, uploaded it to that FTP folder and ran it to edit their fighters' skills. Obviously I've deleted that FTP account now.
I'm not actually deleting them, I've just changed their passwords for now and done a forced logout. I'll delete them properly once their fights are all done then retire the fighters to the Bahamas. All finances have been removed etc. I'm not editing their hype as that would screw over people they're fighting.
Oh and if I've been shit at replying to your emails the last few weeks, this is why; it's been pretty stressful / busy.
To pre-empt some questions.
1. Are you a fucking moron? Yup. Never trust anyone apparently.
2. How long's it been going on? I dunno, I haven't asked yet. I've only spoken to Wolf briefly. Aaron is in Thailand so I'll talk to him when he gets back.
3. Are any of the other alliance members in on it? We looked at their fighters and they looked OK. A couple of them aren't training properly but their fighters' skills look fairly representative of the amount of training they'd done.
4. What happens to fights that are already booked? I have set all their hiddens to 1, so if you're fighting one of them you've basically got a free win. If you want me to just cancel a booked fight if you are fighting one of them, let me know and I will do that. I've also cleared all finances.
5. Was the Russian hack anything to do with it? It wasn't them but maybe indirectly. I asked someone from the game to download a tool to try and find SQL injection possibilities. That tool might have been dodgy and sent that hack attempt our way if it sent a list of sites using the tool back to the programmers. If it was totally unrelated then it's a massive coincidence because we were using the tool that day and the day before.
6. Can you undo a result against their fighters for me? If people feel really strongly about it, I can write a script. I am OK with doing that but I would personally prefer to move on from wasting time on this as it's already wiped out 2 weeks. As it's my fault though, obviously I will do what people prefer.