A New York-based online gaming company has settled a civil complaint that it secretly installed bitcoin-mining code on its subscribers’ computers, netting more than $3,700 worth of virtual currency.
E-Sports Entertainment must pay $325,000 of a $1 million settlement, with the rest forgiven if the company complies with a 10-year compliance program, according to a statement released on Tuesday by the New Jersey attorney general’s office.
E-Sports’ co-founder, Eric Thunberg, and a software engineer, Sean Hunczak, were accused of installing bitcoin “mining” software on 14,000 computers in New Jersey and elsewhere in the U.S. without their users’ consent, creating a botnet.
Both men and E-Sports were charged with violating New Jersey’s Consumer Fraud Act and the state’s Computer Related Offenses Act.
Court documents said the settlement was not an admission of the allegations, but E-Sports acknowledged the issue in May, apologizing and blaming an employee who has since been fired. It said it would donate the mined bitcoins, worth $3,713.55 at the time, to the American Cancer Society.
On Tuesday, E-Sports said it did not agree with the attorney general’s statement on the case.
“The press release issued by the Attorney General about our settlement represents a deep misunderstanding of the facts of the case, the nature of our business and the technology in question,” it said in a statement without explaining further.
Bitcoins baked in
The mining software, which processed bitcoin transactions, tries to find solutions to difficult mathematical problems. If the software finds the solution, the mining operator is rewarded with bitcoins.
The code allegedly developed by the men used the graphics processing units of their subscribers’ computers when users were away and even if the E-Sports software was not turned on, the attorney general’s office said.
“Among other methods, the code detected whether end-users were active on their computers by monitoring end-users’ mouse movements and/or mouse location,” according to the civil complaint.
Hunczak was accused of selling the bitcoins for U.S. dollars, which were then deposited into a personal bank account. An E-Sports subscriber discovered the mining code in May, after it had run on computers since April 12, according to the complaint.
The company sells a $6.95-a-month subscription service to play online games such as Counter Strike and Team Fortress 2 on its servers, which are designed to prevent cheating by players.
The E-Sports software, which must be installed on a subscriber’s computer, gives the company full control over a machine. Part of the code also includes monitoring software, hidden in a software driver, that can report on what applications were running even if the E-Sports software is not active, the civil complaint said.
The civil complaint also said employees in several instances used the software to copy files from users’ computers.
As part of the settlement, E-Sports agreed to regular testing of its security controls and hired a third party to conduct an audit of its privacy and security practices, the attorney general’s office said. The company must also submit to an audit every two years through 2023.