The Bin Weevils Dump Contains Exactly 96,473 Hacked Passwords

HEROIC analysts identified a breach tied to Bin Weevils, an online game aimed at younger players, dated September 2014. The breach exposed 96,473 records containing email addresses, usernames, IP addresses, and MD5 password hashes.

Why This Is Dangerous

MD5 is an outdated hashing method that modern hardware can crack quickly, meaning a meaningful share of these 96,473 passwords are realistically recoverable in plaintext. Because Bin Weevils was aimed at a younger audience, many of these accounts may have been set up with the same password used for a parent's email or another family account.

What Was Exposed in the Bin Weevils Breach

• Email addresses
• Usernames
• IP addresses
• Password hashes (MD5)

Why This Matters

Once a password is cracked, it becomes a key attackers try everywhere else that email address appears. This is the basis of credential stuffing, and for a younger user base, it can mean a parent's reused password is exposed through a child's old gaming account, opening the door to account takeover well beyond the game itself.

How a Database Breach Like This Happens

This incident is classified as a database breach, meaning attackers gained direct access to Bin Weevils' backend systems and exported the user table in a single operation rather than targeting accounts individually. Older gaming platforms like this one often ran on aging infrastructure, which made them an easier target for this kind of full database extraction.

Check If You Are Affected

If you or your child ever had a Bin Weevils account, check whether that email address appears in this exposure. HEROIC's free breach scanner checks your email against more than 400 billion leaked records so you can find out quickly and change any reused passwords.