The CVA Account Hack (2009)

The CVA Account Hack (2009)

The director-account-compromise lineage

By late October 2009 EVE Online's exploit-culture spine already ran the length of the game's history. The Guiding Hand Social Club had codified the in-game director-betrayal pattern in 2005. Cally and the EIB Ponzi had turned it on real-money out-of-game press in 2006. T20's BoB blueprint seeding and Remedial's walk with the Goonswarm titan fund had widened the genre in 2007. The first true account-compromise event - a director's account accessed from outside the game by someone other than its owner - had landed in February 2009 when Haargoth Agamar disbanded Band of Brothers (an in-game defection with shared-cookie precedent). Ricdic's EBank embezzlement had followed in July. The October 2009 event slotted directly between Haargoth and EBank as the first time the disbandment-from-outside-the-game pattern hit a major nullsec alliance through what its leadership immediately identified as a hack rather than a defection.

What made CVA the index case rather than just another data point was the alliance's posture going in. The Curatores Veritatis Alliance had spent five years building the corpus's most stable holder-empire under a strict Not Red, Don't Shoot doctrine; the standing fleet, the role-played Amarr loyalist identity, the multi-corp Holder confederation across Providence all rested on a leadership tier whose director accounts were the structural keystone. The same architecture that made CVA durable made the registry-tier exploit unusually visible when it landed.

28 October 2009: an alliance vanishes

The disbandment surfaced in early Euro-TZ on the night of 28 October. CVA - one of EVE's oldest player alliances - was abruptly gone from the in-game registry. Sovereignty status across most of Providence flipped to neutral pending CONCORD investigation. Within hours the in-character press surfaced the rumour landscape.

The first public confusion landed on the CCP forums at 19:20 EVE time, where ViRUS Pottage opened a thread in threadID 1205168 with the unedited reaction of a capsuleer whose mail client had just gone berserk: "c/d? My alliance mail just got spammed, and all the corps say CVA (Closed) in alliance history". Eight minutes later, at 19:28 EVE time, Taram Caldar of Royal Black Watch Highlanders replied with the line that anchored the entire event to its lineage before any formal statement existed: "We just noticed too.... no idea what's going on. Did CVA just get BoB'd?" The community vocabulary that named the new event - the verb form of to Haargoth an alliance, in the only shape the corpus had for it eight months on - emerged within eight minutes of alliance-mail spam, two hours and thirty-eight minutes before Hardin's formal walkthrough.

Svarthol's Interstellar Correspondents piece, published on the CCP news site that same night at 23:28 EVE time, opened with Elsebeth Rhiannon of Electus Matari sketching what the community already suspected: "All sorts of rumours are circulating, of course. The most popular one seems to be that it was an inside job, possibly including unauthorised access to Neocom." The same piece carried the predator reactions next door. Tigerfish Torpedo of The Crimson Federation - one of the Minmatar-allied pirate outfits CVA had spent years cleaning out of the Deliverance corridor - offered open jeering: "As a lowly Maggot Scum Sucking Pirate, efforts to destroy CVA couldn't have come as better news! I hope to see Ushra'Khan rebuild their power base in Providence, and will offer my full support in doing so. It's a great day!"

The IC piece closed by noting that within hours of the disbandment a temporary alliance had been organised under the name .cva. to give Providence's former CVA capsuleers a banner to fly under while the situation resolved. The crisis was being managed from the inside in real time, in parallel with the first public statements.

Hardin's three-point forensic logic

Hardin, posting on the CCP forums at 21:58 EVE time as a director of Imperial Dreams and effectively the public face of CVA's response, published the official statement that night. It is the load-bearing primary source for the event - the first formal exploit-forensics walkthrough by a major alliance leader, eight months after Haargoth - and it laid out the three-point case for hack-not-betrayal verbatim:

OFFICIAL CVA STATEMENT

I can confirm that CVA was folded and yes we are almost 100% sure it is an account hack for a variety of reasons:

1. We have contacted the relevant player out of game (we have 'real life' contact with him) and he is denying that he did this.

2. The account owner is late US TZ - the disbandment and robbery occurred in early Euro-TZ

3. When the 'hacker' logged in he was only in the basic channels and none of the usual channels that this member is in, indicating that he logged in from a different EVE client.

Hardin then folded in the cultural reference that anchored the forensic case to its own lineage: "Of course he could be lieing to us but the member in question is, as far as we were aware, a loyal member of the executor corp and the CVA for over three years... We do not believe that he would have done this. However, as with Haargoth - you can never be definitively sure - so yes - at this stage it is possible that it is simply a betrayal."

That phrase - as with Haargoth - is the lineage anchor. Hardin was treating the February 2009 BoB disbandment as the structural precedent eight months later: an event whose forensic ambiguity (Haargoth had been a real director who really did betray BoB, but his motivations, recruitment by Goonswarm, and exact authorisation surface had been picked over for months) was now the template by which any disbandment-via-director-account had to be evaluated. The 99% / 1% framing is itself a cultural artefact of that ambiguity: a careful alliance leader, eight months on, could not name the new event as a hack with absolute certainty even when out-of-game contact, time-zone mismatch, and a different EVE client signature all pointed in the same direction.

The forum thread under Hardin's statement ran 13 pages by the time it locked. The replies cluster cleanly: opposing alliances offering condolences and good luck, pirate corps jeering, AAA pilots and Razor Alliance directors wishing CVA a swift return so that their kills could be earned on the field rather than at a keyboard.

The immune response

What happened across Providence over the following hours was, in retrospect, more structurally novel than the hack itself. The CCP IC piece had already noted the formation of the .cva. emergency alliance "to aid capsuleers" within the same window in which it published. Provi-Bloc Holder corporations - Paxton Federation, Libertas Fidelitas, Sev3rance, Aegis Militia, Vigilia Valeria - turned their own fleets out to patrol their constellations under the deliberate-stewardship posture they had spent years sharing with CVA. Across the border, Ushra'Khan made the call that would later define the event in community memory.

Ushra'Khan were CVA's defining ideological opposite. The two alliances had fought the Siege of Ushra'Khan in 2007, with CVA capturing Ushra'Khan's station system and forcing thier retreat to Derelik. The Crimson Federation's pirate jeering on the IC piece had explicitly invited Ushra'Khan to use the moment to rebuild a power base in Providence. Instead U'K fleets formed up and patrolled Providence against opportunist scavengers attempting to claim the lost territory. AAA - Against ALL Authorities, the southern nullsec power that would lead the assault on Providence three months later in the 2010 Providence War - turned up alongside, the same fleets that would shortly be invading the region instead helping to hold it against the opportunist tide while the registry resolved.

The clearest same-day attestation of the immune response sits in Tipa's chasingdings.com blog post that night. Writing from outside both Providence and the CVA-axis altogether, Tipa reported that one of his own corp directors was on the scene and "sends back these screenshots of some of the fleet battles taking place in formerly-placid Providence space right this minute". The image-by-image reporting of fleet engagements in CVA's constellations - posted while CONCORD's investigation was still hours from a verdict - is the contemporaneous proof that the defence fleets were real and the loss was being actively contested in space, not just on the forums. The retrospective view that followed years later corroborates the same-night reporting from across the grid.

The clearest first-person retrospective of the night sits in the comments under a 2019 Ushra'Khan 15-years-birthday post on r/Eve, written by Zonetr00per - a capsuleer who flew under Amarr Empire colours and had ratted in Providence at the time:

But one of my favorite memories was when CVA was disbanded back in 2009: When it quickly became clear the work was the result of an out-of-game electronic breach rather than ingame espionage or treason, U'K fleets turned out within hours to patrol Providence against anyone else trying to claim the lost territory. I remember sitting in a defense fleet as we stared across a grid at U'K - somewhat tense, somewhat bemused, somewhat honored.

Regardless of how real or imaginary that threat was - CCP returned the sov shortly thereafter - I'm only sorry we Amarr never had a chance to return such a favor.

The view is from across the grid. Zonetr00per was CVA-side, defending one of the Holder constellations; the U'K fleet he was watching had no business in Providence under any other circumstance and was patrolling it anyway. The corpus has no earlier documented example of opposing-faction fleets defending a third party's sovereignty against scavengers because the loss had come through an exploit rather than a fair fight. The cultural precedent set that night - that an account-level compromise sat outside the normal rules of EVE engagement, and that the community itself could choose to act as immune system rather than predator - would resurface in different forms in later director-account events.

Resolution and what CCP did NOT do

The operational decision leaked across CVA alliance chat at 23:57 EVE time the same night - three minutes before midnight on the day the alliance had vanished - in a three-line burst captured and posted to chasingdings.com:

[23:57:16] lasterax > GOOD NEWS [23:57:21] lasterax > CVA WILL BE RESTORED PER GM [23:58:04] lasterax > DO NOT SPREAD AROUND PLEASE ALTHOUGH I JUST SAID IT IN ALLIANCE NICE

CONCORD's formal investigation then completed inside a small number of days. The conclusion, as the community wiki's 2010-vintage CVA entry records, was unambiguous: "Concords investigation concluded that the disbandment was the result of outside individual maliciously accessing their data, full sovereignty and alliance information were restored." The same-night chat log is the operational record; the wiki line is the formal one. CVA's registry, sovereignty claims, and inter-corporation standings were all reinstated. The Holder confederation resumed normal operations within the same week. The October 2009 event closed, on the CVA-axis ledger, with the alliance restored and the broader community having performed the unfamiliar role of immune system on its behalf.

What CCP did not publish is as load-bearing as what they did. No CCP devblog accompanied the event. No formal post-incident statement on account security followed. No two-factor authentication system was rolled out as a response to the demonstrated registry-tier exploit. No alliance-restore policy artefact appeared in the official documentation. The entire CCP-side output on the event is the IC breaking-news piece. The registry-hack mechanic that had enabled an outside individual to disband one of EVE's most stable alliances by accessing a single director's account remained the same shape it had been on the morning of 28 October, until much later infrastructure changes years downstream. The broader CVA biography continues at Curatores Veritatis Alliance, which carries the alliance-axis history straight through the 2010 Providence War and beyond.