Consolorama Breach: 18K German Gaming Forum Accounts Exposed

DarkHive discovered a data breach affecting Consolorama, a Germany-based console gaming forum operating at consolorama.de. The breach exposed 18,339 user records and was dated July 6, 2018. Leaked data included email addresses, usernames, IP addresses, and passwords stored using an inconsistent mix of bcrypt and MD5 hashing under a phpBB3 configuration. This mixed password storage reveals inconsistent security practices on the platform, with some user accounts protected by strong bcrypt hashing while others were stored with the far weaker MD5 algorithm.

Why This Is Dangerous

The mixed password storage in this breach is particulary concerning: users whose passwords were stored as MD5 are fully vulnerable to rapid cracking, while the presence of bcrypt for other accounts suggests the platform had uneven security implementations. German gaming forum members frequently reuse credentials across PlayStation Network, Xbox Live, Steam, and other gaming platforms. MD5-cracked passwords from this breach can be directly tested against those high-value gaming accounts. Even bcrypt-protected accounts remain at risk if users reuse passwords, as attackers can verify cracked credentials without needing to break the hash itself.

What Was Exposed

• Email addresses
• Usernames
• IP addresses
• Passwords (inconsistent hashing: bcrypt and MD5 via phpBB3)

Why This Matters

Gaming forum communities are prime targets for credential stuffing because members are highly likely to maintain active accounts on major gaming networks. The inconsistent password hashing in this breach means attackers can selectively target the MD5-hashed subset for immediate cracking while attempting slower attacks against bcrypt hashes over time. Consolorama users who have not changed thier passwords since 2018 and who reuse credentials across gaming platforms remain at risk of account takeover. Breach data from gaming communities is regulary traded on dark web forums and Telegram channels.

How Database Breach Works

In a database breach targeting phpBB3-based forums, attackers exploit vulnerabilities in forum software, unpatched plugins, or server misconfigurations to extract the underlying user database. phpBB3 platforms historically used MD5 for password storage before introducing bcrypt, which explains the mixed hashing found in this breach. Once the database is extracted, attackers use GPU-accelerated tools like Hashcat to crack MD5 hashes at billions of attempts per second using dictionary attacks and rainbow tables. The recovered credentials are compiled into gaming-focused combolists and tested against Steam, PlayStation Network, and Xbox services in automated stuffing campaigns.

Check If You Are Affected

HEROIC offers a free identity scanner that checks your email address against thousands of known breach databases, including gaming forum leaks like Consolorama. If your credentials were exposed, you will recieve an alert with actionable steps to secure your gaming accounts and other platforms where you may have reused the same password. Visit heroic.com to scan your email for free and protect your gaming and online accounts from credential-based attacks.