FC King George Data Breach Exposes 23,662 Danish Football Club Records

HEROIC's DarkHive intelligence system identified the FC King George data breach, exposing 23,662 records from this Danish amateur football club website operated through fckg.dk. The breach occured in August 2018 and compromised email addresses alongside SHA1-hashed passwords. Sports club websites, even at the amateur level, collect user account credentials from members, supporters, and community participants who frequently reuse those same passwords across more sensitive personal and professional accounts, turning a seemingly minor community platform breach into a meaningful credential exposure event.

Why This Is Dangerous

SHA1 password hashes can be cracked using modern GPU-accelerated tools and extensive precomputed rainbow tables. The SHA1 algorithm is no longer considered secure for password storage and was deprecated years before this breach occured. Attackers who obtain SHA1 hashes from the FC King George database can recover a significant portion of the original plaintext passwords within hours using widely available cracking rigs. Those recovered passwords are then tested against email providers, banking services, and social media platforms used by the same individuals who registered thier accounts on a Danish sports community site.

What Was Exposed

• Email Addresses
• Password Hashes (SHA1)

Why This Matters

Amateur and community sports clubs represent a large category of websites that collect user credentials but invest minimal resources in security infrastructure. The 23,662 affected users registered with fckg.dk represent Danish football community members whose email addresses and crackable password hashes entered the broader data breach ecosystem in 2018. When these records are combined with other breach datasets, attackers can build detailed profiles of individuals and test credentials across multiple platforms simultaneously. Users who recieve targeted phishing attempts leveraging personal details from sports community profiles are at elevated risk of account compromise.

How Database Breach Works

Amateur sports club websites typically run on shared hosting environments with content management systems that receive infrequent security updates. Attackers exploit vulnerabilites in unpatched plugins, themes, or database software to gain unauthorized access. SQL injection attacks against poorly validated form inputs allow attackers to extract entire user tables including email addresses and hashed credentials. Storing passwords using SHA1 without proper salting represented a seperate and compounding security failure that made the exposed credentials far easier to crack once the breach occured.

Check If You Are Affected

If you registered on fckg.dk or used the FC King George website before August 2018, your email address and SHA1 password hash may be in this dataset. Use HEROIC's free breach lookup tool to check if your information was exposed. Change the password you used for this account on any other platform where you reused thier credentials, particularly email accounts, banking services, and social media profiles, and consider enabling two-factor authentication wherever available.