RuneScape's 'Mod Jed': convicted for draining accounts from inside Jagex

One of the worst scenarios any player can imagine has just come true in Old School RuneScape. As reported by Vandal, Andrew Lakeman, 32, known in the community as Mod Jed, has been convicted at Cambridge Crown Court after using his position as a developer at Jagex to break into other people's accounts, take gold and valuable items, and resell them on the black market. The haul exceeded €350,000.

This story matters for more than just the figure. We're not talking about an outside hacker or a phishing attempt someone carelessly fell for: we're talking about an employee with the keys to the house. When the threat comes from the very people who are supposed to protect your data, the conversation about security changes completely, and that affects every gaming community, not just RuneScape's.

What you need to know

• Lakeman joined Jagex as a content developer in November 2015 and used his privileged access to loot Old School RuneScape accounts.
• The court handed him three years in prison, but the sentence is suspended for two years.
• He must also complete 150 hours of unpaid work and a 25-day rehabilitation programme.
• Authorities are keeping proceedings open in an attempt to recover the money obtained through the thefts.
• It was Jagex's own player support team that spotted the suspicious pattern in May 2018, and the company set a trap to identify the culprit.

How the case came to light

The thread Jagex pulled on looked routine at first. In May 2018 the player support team came across strange account recoveries: processes in which items and large amounts of gold suddenly vanished. Those recoveries are a mechanism designed to hand control back to the rightful owner, so seeing them turned into the door through which inventories were being emptied set off every alarm.

From there, according to Vandal, the company designed a trap to find out who was behind it. Not all the technical details of the decoy are known, but the outcome is clear: the trail led to one of its own developers, someone who had been at the company since late 2015 and whom the community knew by his moderator nickname.

What this changes for players

The most unsettling part of this case is that the victims did nothing wrong. They could have had a strong password, two-factor authentication and zero clicks on sketchy links: it didn't matter, because the attacker didn't need to guess anything. He had direct access to the internal tools. That's the very definition of an insider threat, and it's a reminder that the security of an account depends as much on the user as on the controls a company places on its own employees.

Where the stolen gold ended up, the black market, also points to a deeper problem RuneScape has been dragging around for years: buying and selling gold for real money. As long as there's demand for gold bought outside the game, there will be someone willing to get it by foul means. That this someone carried the title of Mod is what turns this story into a warning for the whole industry.

Our take

At Underworld Lordz we see two sides to this, and neither is comfortable. First: we applaud Jagex for spotting the pattern and setting a trap instead of looking the other way. Many companies would have preferred to handle the matter quietly to avoid the scandal. Here there was an investigation, a report to the authorities and a sentence, and that sets a precedent we hope other studios take note of.

The second reading is harsher. Three years in prison that end up suspended, 150 hours of unpaid work and a 25-day programme for stealing more than €350,000 by abusing a position of trust strikes us as a response that doesn't match the damage done. To an outsider it's just a number; for the victims it was hundreds of hours of grinding turned into money for someone else. If the recovery proceedings fail to return what was stolen, that sense of impunity will be hard to shake.

For competitive players and content creators, the message is clear: your account is your work tool, and you don't control the entire chain. Demand transparency from studios about who can touch your data, document your inventory and your progress, and treat any odd change to your account as an alarm, not an anecdote. Trust in a developer is earned through internal controls, not a nice nickname on the forums.

What do you think?

The Mod Jed case raises the question of how far a company's responsibility goes when the thief is on its payroll. Do you think a suspended sentence is fair for a theft of this scale, or does it fall short? Let us know in the team chat or on our Discord.