The Destructoid Breach Exposed 59,958 U.S. Gaming Accounts

HEROIC analysts identified a database breach tied to Destructoid, a gaming news and community site based in the United States, exposing 59,958 records. The breach is dated to May 31, 2015. The exposed data includes email addresses, usernames, and passwords, hashed using vBulletin's built-in scheme, a method long considered weak by modern standards.

Why Destructoid's vBulletin Password Hashes Are Easy to Crack

vBulletin's legacy hashing approach is fast and was never designed to resist modern cracking hardware. Attackers using widely available cracking tools and password lists can recover a large share of passwords protected this way without much difficulty. Once cracked, a password is just as usable as one that was never protected at all.

What Was Exposed in the Destructoid Breach

• 59,958 total exposed records
• Email addresses
• Usernames
• Passwords, hashed using vBulletin's built-in scheme

Why This Matters for Destructoid Members

A cracked password from this breach can be tested against other gaming accounts, email providers, or shopping sites through credential stuffing, especially if the same password was reused. Combined with the username and email in the same record, an attacker also has enough to attempt convincing phishing messages. Chained together, this is how a decade-old gaming forum breach can still lead to account takeover, identity theft, or financial fraud today.

How Database Breaches Like This Happen

A database breach like this typically happens when an attacker exploits a vulnerability in the forum software or the server hosting it, then extracts the entire user table in one pass. Older platforms running outdated software, like the vBulletin version behind Destructoid, often carry weaker password protection by today's standards, which means a single breach can expose passwords that are quick for an attacker to recover.

Check If Your Destructoid Account Was Affected

Old forum breaches like this one continue to circulate on dark web forums years after they first occurred, so it is worth confirming whether your information was part of this exposure. HEROIC's free breach scanner checks your email address against a database of more than 400 billion breached records, including this one, so you can find out quickly and take action if needed.