Researchers Link the Galactic Games Dump to 50,040 Stolen Credentials and Phone Numbers in the UK

HEROIC analysts identified a dataset in March 2021 linked to Galactic Games, a now-defunct United Kingdom-based online marketplace that sold new and pre-owned video games. The breach exposed 50,040 user records containing email addresses, phone numbers, password hashes, first names, last names, IP addresses, and salts. Passwords were stored using OpenCart hashes, a format that can be cracked with modern tooling, leaving affected users at continued risk if they have recieved no notification and have not changed their credentials.

What Attackers Can Do with 50,040 Galactic Games Records

The combination of full names, phone numbers, email addresses, IP addresses, and password hashes gives attackers a complete identity profile for each victim. Once hashes are cracked, the plaintext passwords can be tested across banking platforms, gaming accounts, and email providers through automated credential stuffing. Phone numbers add an additional attack vector, enabling SIM-swapping attempts and SMS-based phishing that is partcularly difficult for victims to detect.

What Was Exposed in the Galactic Games Breach

• Email Address
• Phone Number
• Password Hash
• First Name
• Last Name
• IP Address
• Salt

Why Defunct Platform Breaches Create Long-Term Risk

Because Galactic Games is no longer operating, there is no company to notify affected users, issue password resets, or provide breach remediation. This means the 50,040 individuals whose data occured in this breach may never receive an official warning. Attackers know this and specifically target defunct platforms because the victims are unlikely to be alerted, making credential stuffing and account takeover attempts more likely to succeed.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a backend database, often by exploiting vulnerabilities in a web application framework such as OpenCart, using stolen administrator credentials, or targeting misconfigured server permissions. Once inside, the attacker exports the full user table. The stolen data is packaged and distributed on dark web forums, where it is used for credential stuffing, identity fraud, and targeted phishing campaigns.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records, including the Galactic Games database, to tell you whether your email address or credentials appear in any known breach. Run a free check now to find out if your information is accessable to attackers and take action before damage is done.