Project:September 2026 Incident

Horizon Wiki Security Notice

Affected Service

• https://horizonffxi.wiki

Description of Incident

• On September 26, 2026, an attacker gained access to the Horizon Wiki server by exploiting a security vulnerability in a third-party MediaWiki extension.
• The vulnerability was discovered to have been actively exploited on September 28, 2026.
• Based on our investigation, this appears to have been an automated, opportunistic attack targeting MediaWiki installations running the vulnerable extension. There is currently no indication that the Horizon Wiki was specifically targeted.

Data Compromised

• Based on our investigation, no personally identifiable information (PII) was accessed or compromised.
• User authentication for the Wiki is handled through Discord. The Wiki does not directly store users' Discord passwords or authentication credentials.
• At this time, no immediate action is required from users.

Remediation

As part of our response to the incident, we are taking the following steps:

• Credential rotation: All API keys, passwords, and other credentials associated with the Wiki are being rotated as a precautionary measure.
• User reauthentication: Once the Wiki is restored, all users will be required to authenticate again.
• Content restoration: Wiki content will be rolled back to September 25, 2026, which is the most recent date for which we have a verified backup.
• Security review: The affected third-party extension and the Wiki server configuration are being reviewed and secured before the service is brought back online.

What You Should Do

Although we have no evidence that user credentials were compromised, we recommend following standard security practices:

• Use strong, unique passwords for your accounts.
• Do not reuse passwords across different services.
• Enable multi-factor authentication where available.

Important Reminder

Neither the Horizon Wiki Team nor Horizon Staff will ever send you a direct message requesting your password, authentication credentials, API keys, or other sensitive account information.

If someone contacts you claiming to be a member of the Horizon Wiki Team or Horizon Staff and asks for your credentials, do not provide them.