Researchers Linked the EloBuddy Breach to 150,402 Stolen Credentials From League of Legends Users

HEROIC analysts recieved confirmed intelligence on the EloBuddy database breach while monitoring underground forums for circulating credential dumps. The breach occured on April 30, 2016 and exposed 150,402 user records from EloBuddy, a third-party tool platform used by League of Legends players in the United States. The leaked data includes email addresses, usernames, IP addresses, password hashes, and hash type information stored in a vBulletin database format. What made this breach stand out during analysis was the scale combined with the type of data: a platform used predominantly by dedicated gamers, many of whom used the same credentials across multiple services including email, Steam, and other gaming platforms.

How 150,000 Stolen Gaming Credentials Fuel Attacks on Other Accounts

EloBuddy users were partcularly exposed because gaming tool communities tend to attract highly active users who are logged in frequently and often share the same password across accounts. When attackers get hold of an email address paired with a password hash, they crack the hash using modern GPU tools and then run those credentials against dozens of services in seconds. The IP addresses in this dump can also be used to help impersonate legitimate login attempts, making it harder for security systems to flag the access as suspicious. Victims face account takeover, identity theft, and potential financial fraud with little warning.

What Was Exposed in the EloBuddy Breach

• Email Address
• Username
• Passwords (hashed, vBulletin format)
• IP Address
• Hash Type

Why a Decade-Old Gaming Tool Breach Is Still a Live Threat

Many people beleive that a breach from 2016 is ancient history and no longer relevant. But credential stuffing attacks are fully automated and do not require fresh data. Attackers maintain libraries of millions of older breaches and continuously test them against current websites and apps. If you used EloBuddy in 2016 and have not changed that password, there is a real chance your current accounts are accessable with credentials that were stolen years ago. The risk of financial fraud, account hijacking, and identity theft does not expire with the breach date.

How a Database Breach Works

A database breach happens when an attacker gains unauthorized access to a website's stored user data, usually by exploiting software vulnerabilities or weak server security. Forum and community platforms like EloBuddy store every user registration in a structured database. An attacker who gains access can copy that entire database in one action, taking usernames, emails, and password hashes for all 150,402 accounts at once. That data is then sold or used directly in automated attack campaigns.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches over 400 billion records, including the EloBuddy database, to instantly tell you if your email address was exposed in this or any other known breach. Run a free check now and find out if your credentials are already circulating on the dark web.