108,141 BubbleBox Gaming Accounts Leaked With Plaintext and MD5 Passwords

HEROIC analysts found 108,141 gaming accounts from BubbleBox circulating in breach data collections in August 2018. The exposed records contained email addresses alongside both MD5 hashed passwords and plaintext passwords, meaning a large portion of the stolen credentials required no cracking at all. For a gaming platform, this type of exposure is partcularly damaging because players often reuse the same login across multiple services.

Why MD5 Hashes and Plaintext Passwords Are a Double Threat

BubbleBox stored passwords two ways: some were hashed using MD5, an algorithm so outdated that modern computers can crack millions of MD5 hashes per second, and others were stored in plaintext with no protection whatsoever. Attackers who recieved this file could access plaintext passwords immediately and recover most MD5 hashes within hours using freely available cracking tools. The result is that nearly the entire user base was exposed with working credentials.

What Was Exposed in the BubbleBox Breach

• Email Address
• Password Hash
• Plaintext Password

Why Gaming Breaches Feed Bigger Attacks

Gaming accounts seem low-stakes, but players frequently use the same email and password combination on their bank, email, and work accounts. When a gaming platform is breached, attackers test those credentials across hundreds of other services in what is called credential stuffing. The BubbleBox breach alone gave attackers over 108,000 starting points for this kind of automated account takeover campaign, and the data remains in seperate trading collections years later.

How Database Breaches Work

A database breach happens when an attacker finds a way into a company's backend systems, usually through a security flaw in the website, a weak admin password, or an unpatched server vulnerability. Once inside, the attacker downloads the user database, which contains every registered account's stored information. That file is then sold or shared across dark web forums and messaging channels where other criminals use it to fuel further attacks.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against a database containing over 400 billion exposed records, including those from the BubbleBox breach. If your credentials appeared in this or any other known breach, you will find out in seconds. Visit HEROIC.com to run your free scan and protect your accounts today.