Duduniu Breach: 7.3 Million Chinese Gamer Passwords Exposed

HEROIC's DarkHive intelligence system discovered the Duduniu data breach, exposing 7,346,010 records. The breach occured in October 2011 and affected users of Duduniu, a Chinese gaming forum and community platform. Passwords were stored as plaintext, meaning attackers who obtained this data could use every single credential immediately without any cracking effort.

Why This Is Dangerous

Over 7 million plaintext passwords give attackers a massive ready-to-use arsenal for credential stuffing attacks. These credentials get tested against email services, banking apps, gaming platforms, and social networks in automated waves. Chinese users who registered on Duduniu in 2011 and reused thier passwords on other platforms face ongoing account takeover risk from this breach, even many years after the original incident.

What Was Exposed

• Email Address
• Username
• Plaintext Password

Why This Matters

With over 7.3 million records, this breach ranks among the largest plaintext password leaks from that era. Credential stuffing attacks using this data can compromise accounts on platforms completely unrelated to gaming. Identity theft, financial fraud, and account takeover all become easier when attackers hold working email and password pairs that many users likely reused across seperate platforms over the years.

How Database Breaches Work

Gaming communities in 2011 were frequent targets because they often stored user data in poorly secured databases accessible through SQL injection attacks or insecure server configurations. Once an attacker gains read access, they dump the entire user table, capturing millions of records in a single operation. The resulting file circulates across dark web forums and Telegram channels, where it gets merged into massive credential collections that power automated attacks against other platforms for years to come.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like Duduniu. Visit heroic.com to scan your email address and find out if your information was exposed.