Drag2Death Data Breach: 4,413 India Esports Records Exposed in 2023

Drag2Death Breached: 4,413 Indian Esports Community Records Leaked on Hacking Forums

In January 2023, Drag2Death -- an India-based esports community platfrom -- suffered a data breach that exposed 4,413 user records. The breach was discovered when the database appeared on a well-known hacking forum on January 13, 2023. What makes this breach particularly notable beyond its volume is the richness of the data exposed: email addresses, usernames, phone numbers, first and last names, IP addresses, and gender data alongside PHPass hashed passwords. For a relatively small gaming community userbase, this combination of personal identifiers creates a concentrated phishing and social engineering risk that extends well beyond simple account compromise. The fact that phone numbers were included makes the vulnerabel users targets for SMS-based attacks as well.

Drag2Death (January 2023): Breach Summary

• Records Exposed: 4,413
• Data Types: Email addresses, usernames, phone numbers, first names, last names, IP addresses, gender, password hashes
• Breach Type: Database breach
• Password Hash Type: PHPass (Other) -- weaker than bcrypt; vulnerable to offline cracking with modern hardware
• Country Affected: India
• Date Leaked: January 13, 2023

PHPass Hashes: The Password Risk Assessment

PHPass is a legacy password hashing framework that uses a modified MD5 scheme with iterated hashing. While it provides more resistance than plain MD5, PHPass is considered weak by modern standards and is far less resistant to brute-force attacks than bcrypt, Argon2, or scrypt. With modern GPU cracking hardware, PHPass hashes can be broken at rates of millions of attempts per second, making password recovery from the Drag2Death dataset feasible for attackers with even modest computing resources. Any Drag2Death user who reused their password on other platforms -- a common behavior among gaming community members -- faces credential stuffing risk on those secondary accounts even if they have since changed their Drag2Death password.

Phone Numbers in a Gaming Breach: The Smishing and Social Engineering Risk

The inclusion of phone numbers in the Drag2Death dataset distinguishes this breach from a typical gaming platform credential dump. Phone numbers paired with usernames, email addresses, and real names enable highly targeted social engineering attacks. In the Indian gaming community context, threat actors with access to this data could impersonate gaming platform support teams, launch SMS phishing campaigns offering fake tournament prizes, or use the personal identifier combination for SIM-swapping attempts targeting individuals with valuable gaming accounts or cryptocurrency holdings. The 4,413 records represent a small but precisely profiled victim pool for such targeted attacks.

The Broader Pattern: Esports Community Platforms as Breach Targets

Drag2Death is part of a broader pattern of smaller regional gaming and esports community platforms being targeted by attackers. These platforms often operate with limited security budgets, older web application frameworks, and less rigorous security testing than enterprise software. They also tend to store a richer variety of personal data than pure gaming clients -- real names, phone numbers, and social profiles -- making them more attractive targets per record than a simple username/hash database. The Drag2Death breach fits this profile: a niche platform with a concentrated, identifiable user community and data types that extend well beyond basic login credentials.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion exposed records to check whether your email address or credentials appear in the Drag2Death breach or any related database leak. If you were a Drag2Death community member in 2023, your personal data may be in circulation. Run a free search at HEROIC.com to see your exposure status.