EPal Data Breach Exposes 159,713 Order Records, Check Now

HEROIC analysts identified a data breach at EPal (epal.gg) dated 15-Apr-2022, exposing 159,713 records containing email addresses and usernames tied to orders placed on the platform. The data came directly from EPal's own systems rather than from a device infection or a reused-password list. The only way to know for certain whether your information is part of it is to scan your email.

What someone could do with this data

Even without a password in hand, an attacker who has your email address and username can build a convincing, personalized phishing message, since they already know you used this specific platform. Matching usernames across sites can also help an attacker map out your other accounts.

What the EPal Order Records Contained

• Email Address: confirms you used EPal and gives attackers a direct way to contact you.
• Username: can be reused to search for your presence on other platforms and strengthen targeted scams.

Real-world consequences

With no passwords involved, the main risk here is phishing: a message that references your real EPal account activity to trick you into handing over a password or payment details elsewhere. Combined with other leaked data you've been exposed in, these records can help build a more convincing attack.

How this breach happened

This data came from EPal's own systems being accessed without authorization, rather than from malware on a user's device or a list of reused passwords. The exposed order records were then distributed without the company's involvement.

Find out if you were affected

Scan your email to check whether it appears in this breach. If it does, stay alert for emails or messages that reference EPal specifically, since they may be phishing attempts built from this data.

Check both your personal and any work email you may have used on EPal, since either could be affected.