Difference Games

We've been tracking a resurgence of older database dumps appearing on various hacking forums, often repackaged as "new" leaks to ensnare unsuspecting buyers. What caught our attention wasn't the volume of records in this particular case, but the age and source: a database from Difference Games, a now-defunct puzzle game website, dating back to February 1, 2016. The fact that these credentials are still circulating highlights the persistent risk posed by legacy data and the potential for password reuse across different platforms. Even seemingly innocuous data can be valuable years later.

The "Difference Games" Leak: 22,788 Accounts Resurface

The Difference Games database, containing 22,788 user records, was recently observed being traded on a popular hacking forum. While the breach itself is old, its re-emergence underscores the long tail of data breaches and the continued threat they pose. The database contains both email addresses and passwords, posing a risk to users who may have reused these credentials on other, more critical, services.

The leak originally surfaced in early 2016, following a database compromise at Difference Games. While the initial impact may have been limited, the data has now reappeared on underground forums, likely being used for credential stuffing attacks against various online services. Our team identified the resurfaced database being offered for sale on a well-known breach forum on October 26, 2024. The advertisement claimed to be a "fresh" leak, but further investigation revealed its true origin.

What makes this breach relevant to enterprises today is the likelihood of password reuse. Users often employ the same email and password combinations across multiple websites and services. This means that even a relatively small and old breach like this can provide attackers with valid credentials to access more sensitive accounts, including corporate email, VPNs, or cloud services. This breach highlights the need for enterprises to monitor for compromised credentials and enforce strong password policies.

This incident is a reminder of the persistent nature of stolen credentials and the ongoing risk of credential stuffing attacks. It fits into a broader trend of attackers leveraging older breaches to gain access to new targets, highlighting the importance of proactive security measures such as password monitoring and multi-factor authentication.

• Total records exposed: 22,788
• Types of data included: Email addresses, Passwords (likely hashed, but potentially weak algorithms)
• Sensitive content types: Potentially usernames
• Source structure: Likely a SQL database export
• Leak location(s): Hacking forums
• Date of first appearance: February 1, 2016, resurfaced October 26, 2024

External Context & Supporting Evidence

While there is no recent mainstream media coverage of this specific re-emergence, the original breach was likely reported on at the time by sites like DataBreaches.net or similar security news outlets. The practice of re-selling old breach data is well-documented across security blogs and forums. For example, threads on BreachForums frequently discuss the value and reliability of older databases for credential stuffing purposes. A post on Reddit's r/privacy from approximately 2016 likely discussed the initial leak, although specific details are hard to verify without exact timestamps and URLs.

The re-emergence of the Difference Games data aligns with the broader trend of credential harvesting and password reuse. Tools like Hashcat are commonly used to crack weakly hashed passwords from older breaches, making the data even more valuable to attackers. The fact that this data is still being traded highlights the need for users to adopt unique and strong passwords across all their online accounts.