The Capital of Games Breach Quietly Exposed 505,773 Accounts

HEROIC analysts identified a database breach affecting Capital of Games, an online gaming community site, dated November 6, 2015. The breach exposed 505,773 records, including email addresses, usernames, IP addresses, password salts, and password hashes protected with vBulletin and bcrypt hashing.

Why the Capital of Games Breach Is Dangerous

The presence of both salts and bcrypt hashing for a portion of these passwords is a genuinely good sign, since bcrypt is designed to resist cracking. However, older vBulletin (VB) hashing mixed into the same dataset is far weaker, and any password recovered from either method can be tested against other accounts the same person owns, especially email and gaming platforms.

What Was Exposed in the Capital of Games Leak

• Email addresses
• Usernames
• IP addresses
• Password salts
• Password hashes (VB and bcrypt)

Why This Matters

At over half a million records, this breach gives attackers a large pool of accounts to target with credential stuffing. Gamers frequently reuse logins across platforms, storefronts, and payment services, so a cracked Capital of Games password can become the key to a much more valuable account elsewhere.

How Database Breaches Like This Happen

A database breach means an attacker gained direct access to the site's backend storage and copied the user table wholesale. The mix of hashing methods found here, VB alongside bcrypt, suggests the platform was migrating password security over time, but everyone registered before that migration remained more exposed than newer accounts.

Check If You Are Affected

If you ever created an account on Capital of Games or a similar gaming forum, find out if you were affected. HEROIC's free breach scanner checks your email against more than 400 billion compromised records, including this one, in seconds.