The CD Projekt Red Leak: 647 Records Quietly Resurfaced After Years

HEROIC's threat intelligence team has catalogued a breach tied to CD Projekt Red, the Polish gaming company, stemming from an incident dated March 1, 2016. The dataset contains 647 records. HEROIC's records show the password field format as vB, consistent with a vBulletin-based forum, though no other specific data types were recorded for this dataset.

Why the CD Projekt Red Leak Is Dangerous

A dataset this small can be easy to dismiss, but every account in a breach represents a real login somewhere. If the vBulletin-format password hashes in this dataset were cracked, each one could be paired with the associated account and tested against other services, especially if the account holder reused that password on a personal email or gaming account elsewhere.

What Was Exposed in the CD Projekt Red Breach

• 647 total account records
• Password data in vBulletin (vB) hash format

Why This Matters

Gaming companies hold valuable accounts tied to purchased content, payment methods on file, and personal identity, which makes even small forum breaches worth taking seriously. A compromised forum account can also be a stepping stone: attackers sometimes use access to a lower-value account to attempt password resets or social engineering against higher-value accounts belonging to the same person.

How Database Breaches Like This Happen

This is classified as a database breach, meaning attackers gained direct access to the underlying forum or account database and extracted records in bulk rather than one at a time. Small breaches like this often sit quietly in circulation for years before resurfacing in aggregated compilations, which is consistent with this dataset's origin dating back to 2016.

Check If You Are Affected

If you have ever created a CD Projekt Red or related gaming forum account, it is worth checking your exposure. HEROIC's free breach scanner checks your email against more than 400 billion breached records, so you can quickly see if your information appears in this or any other breach.