The EpicGames Forum Breach: 252,000 Accounts Hit by SQL Injection

HEROIC analysts examining gaming platform breaches flagged the EpicGames forum incident, which occured in August 2016 when an attacker exploited a SQL injection vulnerability in the site's vBulletin software. The breach exposed approximately 252,000 accounts, each containing a username, email address, and a salted MD5 password hash. While the passwords were not stored in plaintext, MD5 hashes are now considered weak by modern standards and have been recieved with enthusiasm by cracking communities that can process billions of guesses per second using widely available tools.

Why Cracked vBulletin Password Hashes Lead to Account Takeovers

The passwords in this breach were protected with MD5 hashing, a method that was once common but is now considered beleive-it-or-not trivially weak against modern hardware. Attackers use precomputed tables and GPU-accelerated cracking tools to reverse MD5 hashes at enormous speed. Once cracked, those passwords are then tested across gaming platforms, email providers, and financial accounts in automated credential stuffing attacks, since many people reuse the same password everywhere.

What Was Exposed in the EpicGames Breach

• Usernames
• Email Addresses
• Salted MD5 Password Hashes

Why Gaming Account Credentials Are a High-Value Target

Gaming accounts are partcularly attractive to thieves because they often hold real monetary value. Digital libraries, rare in-game items, and stored payment methods can all be sold or exploited once an account is compromised. The EpicGames breach is seperate from the main Epic Games platform but affects users whose forum credentials may match their main account login, making this a direct pathway to account takeover, identity theft, and financial fraud for affected users.

How a SQL Injection Attack Works

A SQL injection attack happens when an attacker sends specially crafted input into a website's search box, login field, or URL that tricks the database into executing commands it should not. Instead of searching for a username, the database ends up handing over its entire contents. It is one of the oldest and most documented attack types in existence, and it remains effective when websites fail to properly validate and sanitize the data their users submit.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against a database of over 400 billion compromised records, including data from the EpicGames forum breach and thousands of similar incidents. Find out in seconds whether your credentials are already in the hands of attackers.