The AssettoCorsa Mods Breach Put 78,017 Email Addresses and Usernames Online

The AssettoCorsa Mods breach put 78,017 stolen email addresses and usernames from the popular Assetto Corsa racing sim mod community online in January 2025. HEROIC analysts identified the exposure on January 4, 2025, when a database dump from the assettocorsamods.net platform surfaced on underground forums. The data was drawn directly from the site's user account database.

Why This Is Dangerous

Gaming community accounts are frequently targeted because many users register with the same email address and password they use on financial and streaming services. Once attackers have a confirmed email and username pair, they can test those credentials across hundreds of other platforms automatically. Even without a password in this breach, the confirmed email and username combination helps attackers narrow their credential stuffing attempts significantly.

What Was Exposed in the AssettoCorsa Mods Breach

• Email addresses
• Usernames

Why This Matters for Gaming Community Members

Exposed email addresses from gaming platforms are a reliable starting point for phishing campaigns. Attackers send messages that mimic game developers, mod sites, or account security alerts, tricking users into entering credentials on fake login pages. Usernames that match handles on other platforms, such as Steam, Discord, or Reddit, can also enable targeted harassment or impersonation. For users whose email is tied to a Steam or Epic Games account, the risk of account theft is real and financially meaningful given the value of gaming libraries and in-game items.

How a Gaming Site Database Breach Works

Fan-run modding sites and gaming community platforms often operate on small budgets with minimal security overhead. Database breaches on these sites commonly result from outdated CMS software, unpatched plugins, or weak admin credentials. An attacker who gains database access can export the entire user table in minutes. The resulting file, containing emails and usernames, is then posted to breach forums or sold in bulk to operators of credential stuffing campaigns. The site may not even be aware the breach occurred for days or weeks.

Check If Your Information Was Exposed

HEROIC's breach scanner searches across more than 400 billion compromised records. If you had an account on AssettoCorsa Mods or use the same email address on other gaming platforms, check your exposure at heroic.com. If your email appears in this or any other breach, update your password on all connected accounts and consider using a unique email alias for gaming registrations going forward.