Broken Rules contacted PayPal and put a stop to the spending, and PayPal assured the studio that all of its money would be returned. Pichlmair said he believed the account's password was cracked. Broken Rules since regained full control over its own account, making it safe for backers to continue donating.
"This feels like someone breaking into your house and we were super-stressed out for a whole day," Pichlmair says. "We're on the last stretch of our crowdfunding campaign and this incident is really taxing .... Gladly there wasn't too much money on our PayPal account at that point."
Secrets of Rætikon has a $40,000 campaign on Indiegogo and has raised $10,900 with three days to go – but it's a Flexible Funding project, meaning Broken Rules gets to keep whatever money it makes, regardless of reaching its goal. Secrets of Rætikon was a stylish exploration and puzzle game that we dug at GDC Europe this year.
All that Broken Rules had to identify the hacker was a "dodgy Gmail address," so there wasn't much chance of catching anyone, Pichlrmair said. As for the return of its stolen money, he said he'd believe it when he saw it. Pichlmair planned to update backers no matter how the hack shook out.
"We try to be honest even if it is to our detriment," he said. "That's us."