Analysts Tie 7,651 Plaintext Passwords to My.Games Breach

HEROIC analysts identified a database breach affecting My.Games, a European gaming platform headquartered in Amsterdam, Netherlands, on August 18, 2024. The incident exposed 7,651 records containing email addresses and plaintext passwords. Unlike hashed credentials, plaintext passwords require no cracking step and can be used immediately by anyone who obtains the data, making this breach particularly severe for the affected users.

Why This Is Dangerous

Plaintext password exposure is among the most serious outcomes of a data breach. Attackers can take the confirmed email-and-password pairs from the My.Games leak and immediately attempt to log into other platforms such as email providers, social networks, and financial services. Because many users reuse the same password across multiple sites, a single plaintext credential dump can enable a cascading wave of account takeovers far beyond the gaming platform itself. Attackers also use this data to sell verified account credentials for in-game assets and currency.

What Was Exposed

• Email Address
• Plaintext Password

Why This Matters

Gaming platforms are high-value targets because user accounts often contain stored payment methods, earned in-game items, and virtual currency with real-world monetary value. Credential stuffing attacks using plaintext passwords allow threat actors to take over accounts without any technical cracking effort. Affected My.Games users face risks including unauthorized purchases, account lockout, sale of stolen accounts on underground marketplaces, and compromise of any other service where the same email and password combination was used.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a company's data storage infrastructure. Common attack vectors include SQL injection vulnerabilities in web-facing applications, exploited server misconfigurations, and stolen or brute-forced administrative credentials. Once access is obtained, user tables can be exported in seconds. The exfiltrated data then circulates on dark web forums and private Telegram channels, where it is bought and sold or distributed freely depending on the attacker's goals.

Check If You Are Affected

If you have ever registered an account on My.Games or any associated gaming properties, your email address and password may have been exposed. Use the HEROIC free breach scanner to check your email against our database of 400 billion or more compromised records and see whether your credentials appear in this or any other known breach.