What can be done to recover from an exploit-related PR disaster?

Question

Let say company x makes massively multiplayer online strategy games. The game y is updated adding a feature z, but developers forgot to add server-side verification or it was bypassed (using alternative UI). Update allowed users to double their units as many times as they like. After about a day this bug was fixed. A lot of members had abused this bug - some by accident(?), others as much as possible. Damage has been done and extra units still remain.

The game has a cash shop where speedups, elite units, etc can be bought. Some members have spent hundreds of dollars to be among the best and played this game for several months if not years.

I want to know : what can be done, if rollback is not possible?

Answer 1

In this situation, after fixing the bug, the company has three options:

1. Ignore the problem. If it's a low-impact problem, just ignore that it's happened. Ill-gotten gains remain ill-gotten. This is by far the easiest option (and in practice, the one which is used the most frequently), but if customers are really upset about the problem, it might not be the best one.
2. Roll-back the game state to before the exploit happened. This can be extremely unpopular, and it can often be difficult to pinpoint exactly when the exploit started. The further in the past the exploit began, the more painful this option will be for the customer base. But if it's only a few hours, then this is probably a reasonable option.
3. Try to fix the problem on a case-by-case basis, using server log analysis. In this approach, you analyse your server logs to figure out where exploits happened, and undo those exploits in a post-hoc manner. This is the approach that customers are usually happiest with, as long as your server logs allow you to do it accurately and fairly. (This is just one reason why verbose and detailed server logs are critically important for online multiplayer games!)

Note that if your game is commercial, there are potentially legal issues with both #2 and #3 above; accidentally wiping out goods which were purchased with real money can get you in a lot of real-world trouble. So check with lawyers in your jurisdiction in that situation.

As Michael Madsen mentions, Warnings and bans are an option for punishing users who engage in exploits. But they don't actually fix the problem introduced into the game by the exploit; they just punish the people responsible.

Answer 2

This will inherently depend on the exact situation, but usually, TOSes include something about exploitation of bugs being a bannable offense.

Whether or not the company bans everyone who ever did it, or only those where they are certain that they're deliberately exploiting (e.g. people who did it more than once) depends on the company and exact scenario.

For example, if it can be argued that it is quite easy to stumble across the bug by accident, then you may well make the situation worse by banning everyone who has done it - because it stands to reason that not everyone did it on purpose, and if you ban those accidental violators, it comes off as a bastard move.

If you can't reasonably figure out who to ban, the best choice may be to just admit it and apologize profusely to your player base, possibly offering some sort of compensation for the screw up, and just leave it at that.

Regardless, you should then figure out how it came to this situation, and then take steps to avoid that in the future. You don't want this sort of thing happening again.