If You Reuse Passwords, the Evony.com Leak Should Worry You

HEROIC analysts flagged the Evony.com breach while tracking large credential datasets being traded on dark web forums and Telegram channels. The breach occured in May 2016, when the online multiplayer game Evony had its database compromised, exposing 25,105,516 user accounts. The leaked data included email addresses, usernames, IP addresses, and passwords stored as MD5 hashes without salt. Analysts beleive the dataset has been recirculated in aggregated credential dumps used for credential stuffing campaigns targeting gaming and general consumer platforms.

Why Unsalted MD5 Passwords From Evony.com Are Accessable to Attackers

MD5 passwords stored without a salt are among the easiest types of hashed credentials to crack. Attackers use precomputed lookup tables called rainbow tables to match hashes to their original passwords in seconds. Once they have your real password, they can test it against your email account, streaming services, online banking, and workplace logins. The inclusion of IP addresses in this dataset also gives attackers a rough idea of where users are located, which can be used to make phishing messages more convincing.

What Was Exposed in the Evony.com Breach

• Email Addresses
• Usernames
• IP Addresses
• Passwords (MD5 hash, no salt)

Why the Evony.com Breach Is Still Relevant Today

With 25 million records, this dataset is large enough to support industrial-scale credential stuffing operations. Attackers run automated bots that test each email and password combination against hundreds of popular websites simultaneously. If you used the same password on Evony that you used on your email or bank account in 2016, and you have not changed it since, that account may be at risk of takeover today. The Evony.com breach is a clear example of why password reuse creates long-term exposure to identity theft and financial fraud, seperate from any connection to the original game.

How a Database Breach Works

A database breach happens when attackers gain unauthorized access to the servers that store a company's user records. In the case of online games, this often involves exploiting vulnerabilities in web applications or using stolen administrator credentials. Once inside, the attacker copies the entire user database and publishes or sells it. Because gaming platforms store email addresses and passwords for millions of users, a single successful breach can fuel account takeover attacks for years afterward.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against more than 400 billion records, including the full Evony.com dataset. Head to HEROIC.com to find out whether your credentials from this breach or any other incident are currently in the hands of attackers, and get personalized steps to secure your accounts.