Gamers Targeted in the 1.8M-Record Flash Flash Revolution Breach

HEROIC analysts identified a database leak tied to Flash Flash Revolution, a music-based rhythm game platform (flashflashrevolution.com). The breach is dated February 1, 2016, and exposed 1,768,328 records, including email addresses, usernames, IP addresses, and passwords hashed with salted MD5, along with the salt values themselves.

Why a 1.7 Million-Record Gaming Breach Is a Big Deal

This is one of the largest datasets in this batch, and scale matters. With nearly 1.8 million accounts exposed, this leak gives attackers a massive list of real email and username combinations to work through. The passwords were salted before hashing, which is a better practice than plain MD5, but salted MD5 is still considered weak against modern password-cracking hardware, so a meaningful share of these passwords are realistically recoverable.

What Was Exposed in the Flash Flash Revolution Database

• Email addresses
• Usernames
• Password hashes (salted MD5)
• Salt values
• IP addresses

Why This Matters for 1.8 Million Former Players

A rhythm game account might not feel sensitive, but many of these 1,768,328 players likely used the same email and password on other, more important accounts. Once a salted MD5 hash is cracked, attackers plug the recovered password into credential stuffing tools that automatically test it against banking, email, and shopping sites, hoping for a match that leads to full account takeover.

How a Salted MD5 Database Breach Happens at This Scale

This incident is classified as a database breach. A leak of this size typically comes from a vulnerability or misconfiguration in the site's software that lets an attacker copy the entire user table, including hashed passwords and salts, in a single action. Once outside the original system, attackers use cracking tools and known password lists to work through the weaker hashes, converting them back into usable plaintext over time.

Check If You Are Affected

With nearly 1.8 million accounts involved, there's a real chance your email address is part of this leak. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, so you can see your exposure and update any passwords you're still using elsewhere.