36,434 Passwords From the playtestVR Breach Hit a Hacking Forum

36,434 Passwords From the playtestVR Breach Surface Again

In August 2018, a dataset from playtestVR, a now-defunct US virtual reality game testing site, was posted on a hacking forum. HEROIC analysts confirmed the dataset contains 36,434 records made up of email addresses and MD5 password hashes.

Why an MD5 Password Hash Still Puts You at Risk

MD5 was never built to resist modern cracking hardware. Attackers can run a leaked MD5 hash through freely available tools and lookup tables and recover the original password in seconds for anything short, common, or previously seen in another breach. Once cracked, that password works exactly like a stolen plaintext credential.

What Was Exposed in the playtestVR Breach

• Email addresses
• MD5 password hashes

Why This Matters Even Though playtestVR No Longer Exists

A defunct company does not make its old breach harmless. Cracked email and password pairs from playtestVR get folded into combolists, the large master lists attackers use for credential stuffing against active accounts. If you ever used the same email and password combination anywhere else, that account can be taken over years after the original site shut down, leading to financial fraud or identity theft.

How a Combolist Breach Like playtestVR Spreads

When a database like playtestVR's is stolen, the raw hashes are usually cracked over time and merged with data from other breaches into a combolist, a single file pairing emails with working passwords. These combolists get traded and reused for years, which is why a 2018 breach can still show up in credential stuffing attempts today.

Check If You Are Affected by the playtestVR Breach

HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, including older breaches like playtestVR. Run a scan to see if you are affected and update any password you have reused since.