If You Had an Account on Assinatura-Xbox-Live, Your Phone Number Was Leaked

HEROIC analysts flagged the Assinatura-Xbox-Live breach while monitoring underground forums where gaming platform credentials are traded. The breach occured in January 2021 and exposed 41,141 records from this Brazilian eCommerce platform selling Xbox game codes and subscriptions. The leaked data includes full names, email addresses, phone numbers, IP addresses, and password hashes, all recieved by threat actors who distributed the database across dark web marketplaces.

Why Full Names, Phone Numbers, and Password Hashes Are a Dangerous Combination

This breach exposed a rich set of personally identifiable information alongside account credentials. Attackers can combine first name, last name, email, and phone number to impersonate victims in social engineering attacks, SIM swapping schemes, and account recovery fraud. The MD5 with salt password hashes, while slightly harder to crack than plain MD5, are still seperate from modern standards and can be reversed with targeted GPU-based cracking rigs. The result is a complete identity and credential package that fuels financial fraud and account takeover attacks.

What Was Exposed in the Assinatura-Xbox-Live Breach

• Email Address
• Phone Number
• Password Hash (MD5 with Salt)
• First Name
• Last Name
• IP Address
• Salt

How Gaming Platform Breaches Lead to Financial Fraud

Assinatura-Xbox-Live handled digital transactions for Xbox subscriptions and game codes. Attackers who gain access to this data can attempt credential stuffing against Xbox Live itself, PayPal, and Brazilian payment platforms. Phone numbers enable SIM swap attacks, which bypass SMS-based two-factor authentication. Combined with full names and email addresses, this breach gives attackers enough information to pursue identity theft and unauthorized financial transactions. Credential stuffing tools can test these credentials against dozens of services within minutes.

How Database Breaches Work

A database breach occurs when an attacker exploits a vulnerability in a web application or server to extract stored user records. Common methods include SQL injection, insecure API endpoints, and compromised hosting credentials. Once the database is exported, attackers sell or share it on dark web forums and Telegram channels. Gaming and eCommerce platforms are frequent targets because they store both personal data and payment-related account credentials, making the stolen data immediately monetizable.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against a database of over 400 billion compromised records, including the Assinatura-Xbox-Live breach. Run a free check now to find out if your personal information was exposed and what steps to take to protect your accounts.