We wanted to address the recent incident that occurred during the Hearthstone Masters Tour Las Vegas last week.

Due to a side channel data leak, class information was available for 6 hours before the deck submissions were locked on June 14. This was limited to class info, all Personally Identifiable Information (PII) is secure.

We are incredibly sorry and apologize to any affected players. We know the trust the Hearthstone community places on us to ensure the competitive fairness of the Hearthstone Masters Tour. While we cannot go back in time, we can explain what happened, the lessons we’ve learned, and what steps we are taking to future proof this.

Timeline, Fix, and Next Steps

• Battlefy was initially notified about the issue the morning of June 14th. Internal investigation began immediately.
• The first endpoint was disclosed to Battlefy at 8:42 am PDT by the community and was closed by the Battlefy development team at 11:26 am PDT.
• A second endpoint was disclosed to Battlefy at 3:57 pm PDT by the community and was closed by the Battlefy development team at 4:52 pm PDT.

After closing the endpoints, we took a step back and reviewed our entire tournament registration and deck submission systems.

Over the weekend following the Friday leak, we completed the migration of decklist and class information to separate game data from tournament match data, such as the scores and winner. We then re-designed our backend architecture, so the fetching of game data will go through more rigorous access-control logic to ensure it is only available at the time an organizer chooses.

For those who have known us over the years, we are Hearthstone players who have supported the competitive scene since day one. As the competitive experience evolved over time, we also made changes to Battlefy such as support for Specialist, decklists, and open & closed formats. However, this incident has helped us rethink how we build products and communicate with our community. Your feedback is a key part of our development process and helps inform the features we build.

As competitive players you deserve the best platform to compete on, and we are committed to delivering that. Battlefy was built for the esports community, and competitive integrity will always be extremely important to us. In the future we will have more frequent and transparent communications to make sure your ideas and feedback are reflected in the platform.

Simply put, we can do better. We will work hard to earn the trust placed in us, and provide the best-in-class service you deserve.