Yeah, sure, SW got nuked and chaos rained from the sky. But let’s be real: the hacker exposed what should have been fixed years ago: massive security holes, lazy admins, a site held together with duct tape and wishful thinking.

And what did the so-called "authorities" do?
Did they patch the holes? Secure the site? Protect the players?

Nope. They grabbed whoever they could and started tossing them in jail like some kind of dictator having a bad hair day. Because when you can’t fix the system, you punish the people pointing out it’s broken. Classic.

Nullplayer’s not a zero. Hero all the way.

Interview with replytotibby

What were your intentions in hacking the site? What message do you want to send?

 Not really much, I just want those problems fixed. As I said on the post, besides the fun of it (coding bots, wrecking havoc, causing chaos and seeing people's

reactions), I dislike irresponsible admins and lazy devs.

Why destroy peoples’ outfits?

I just wanted to show it's possible. Just messing with the war rankings seems too bland.

How did you choose whose outfits would be nullified?

I chose the most active ones, the ones who apparently were online the most, xeeting and participating on events. It seems to me that there is a specific group of players who know each others well and play a lot. And Katie because she's a disgrace to management. I used to be an admin for other games and website communities too, and I was proud of what I did. She just seems to want control over people. I also focused on people who annoyed me slightly or were really focused on the whole situation, as well as went completely random on some people, or used them to re-test the script.

What made you choose state war as a specific event to hijack?

I didn't hehe but I saw the chance for some fun on it because it seemed like a major event.

How do you know Katie? You referenced her personally.

After hacking I kept checking the website for the admins' reaction and players' as well, which is where most of the fun lies.

When did you first play Ximboland, and how would you describe the state of site safety then?

I can't tell when I first played becuase that could, maybe, tell on me, but it has passed some years since then. Site safety was the same as now - exactly the same, nothing changed. New games, however, do seem a bit safer than old ones (or I just don't know sliding puzzle works and don't have the patience to try)

Unfortunately the user doesn’t go into detail on their history with the site, leaving investigators with few clues into their identity. They claim the attack isn’t driven by personal vengeance, but little is known of their relationship to Ximboland.

The response

This and the provided javascript signals that anyone could gain access to player outfits, forum functionality and other functions like State Wars. What remained unknown for more than a week is the full extent of the vulnerability in 2025. SweetasNuts had not commented on the specific vulnerabilities of the site, nor had admin Mariolka and Sachem, until 6 days later, the 26th.

After the popular jailing of nullplayer, citizens were widely in support of Minister KatieBoutique, commenting widely in thanks for doing what she could to stop the hacker with the tools available to the Ministry of Justice. Replies to MoJ’s Xeets on the 20th are rife with comments like “Thank you Katie! ❤️” from user TokiKonoe, “rare katie W” from user alexa pro, and other cheers for the chief of the Fashion police.

The first official response came from Prime Ximbo and reigning autocrat SweetasNuts on the 21st, a post titled Ximboland is under attack. In it, the Prime Ximbo is vague about the attack, providing information whose relevance is argued in the replies: “Preliminary reports from the Minister of defence suggest that this was an act of treason from someone whom knows about Ximboland from within rather than an act of war from a foreign land. It goes without saying that when we catch the traitor then their punishment for this will be the complete deportation from Ximboland into permanent exile and we will notify the relevant legal authorities of their new homeland for illegally hacking into a private property. Justice will be served.”

The post provided no information about how the hack was possible, or what steps were being taken to secure the site. But the autocrat was quick to assuage nerves about the security of payment information. “A reminder that we store ZERO banking information in Ximboland so there is no information that you share with us that could be valuable to hostile foes like the idiot killjoy who did this. We use a 3rd party payment provider (paypal) exactly for this reason ie we have nothing of particular value to anyone. So please dont worry.” This comes despite the fact that PayPal authorizations may very well be vulnerable as well.

With no direction for Pink House officials or guidance on what game features were safe, confusion and uncertainty loomed, on the 21st, chaos continued to spread. The outgoing Minister of Justice, with less than two weeks remaining in their term, Xeeted plans for jailings, on the grounds that “The leftists … brought The Hacker here, whether directly, or indirectly, through your actions, Xeets, attitudes, and glorifications of hatred, drugs, violence, and death.”

These arbitrary jailings were going to take place according to KatieBoutique, until Administration reached out to MoJ with instructions.

“I am not done jailing people on the left who brought The Hacker here, whether directly, or indirectly. Until the admins figure out what to do…and let me know what they want me to do, I will continue jailing people as I see fit.” The reaction had changed swiftly.

“Nope. Wasn’t that. I don’t care if you’re trying to rage bait, trying to blame other users on the site when this is very clearly a failing of Chris/SAN and admin isn’t productive and sure as shit won’t get you your money back,” wrote user Katrynah.

“Come on, I don't think they brough the hacker, this jailing is completely unjustified and undeserved ... People will just start deleting their accounts and the game will not be fun anymore :(“ Wrote user Isolde.

Things escalated from there. Minister of Justice KatieBoutique then jailed Minister of Entertainment Tibby, claiming she was “on good terms with The Hacker,” going on to threaten her with indefinite jailing until the end of the term in May. Freethinkerland General KirstyD8 commented criticizing the jailing. “I think they need to be able to communicate with Chris and they can't do that in jail. Mostly Tibby.”

The Minister of Justice posted public accusations that the hack was done by the boyfriend of former PX bxdcherri. No evidence was provided, but bxdcherri was banned permanently by Administration soonafter.

This unnerving and controversial series of events, following shortly after the sitewide shock in response to threats of the publication of revenge porn, led to the publication of a series of protest items in the shops. The item’s publication led to several permanent bannings. More on this in the next issue of the Bimbo City Breaking.