The GameForce Leak: 7,708 Passwords Exposed. Yours Might Be One.

HEROIC analysts reviewed a dataset tied to GameForce, a Dutch hobby shop, that was shared on a cybercrime forum with a leak date of August 26, 2018. The data includes 7,708 records made up of email addresses and MD5 password hashes. This incident has not been independently confirmed by GameForce itself, so treat the company attribution as reported rather than verified, but the credential pairs themselves are what matters most for anyone checking their own exposure.

Why This Is Dangerous

MD5 is an old hashing method that modern computers can crack quickly, especially for passwords that are short, common, or based on dictionary words. That means a hash in this dataset is not much of a shield. Anyone who obtains this file can run it through widely available cracking tools and, for a large share of the 7,708 records, come out the other side with a plain, usable password.

What Was Exposed

• Email addresses
• Password hashes, using the MD5 algorithm

Why This Matters

Once passwords are cracked, the risk becomes credential stuffing: automatically trying each email and password pair against other popular sites in case the person reused it. Given this data dates back to 2018, some passwords may since have been changed, but plenty of people never update passwords on accounts they consider minor, which is exactly the gap attackers count on. From there, a successful login can open the door to account takeover, identity theft, and financial fraud on completely unrelated services.

How Database and Combolist Breaches Happen

This type of incident typically starts with an attacker finding a weakness in a website's database, whether that is an unpatched vulnerability, a misconfigured server, or exposed admin credentials, and using it to copy out the full user table. Once extracted, the stolen email and password hash pairs are often combined with data from other breaches into what is called a combolist, then shared or sold on cybercrime forums where anyone can download it. The hashes stay attached to the emails throughout this process, which is why the strength of the original hashing algorithm matters so much.

Check If You Are Affected

If you ever had an account with GameForce or reused a password across shopping sites around 2018, it is worth finding out whether your details are part of this dataset. HEROIC's free breach scanner checks your email against a database of more than 400 billion leaked records, so you can see your exposure and update any passwords still in use.