The GameGrin Breach Gave Hackers the Data to Target Every Gaming Account You Own

HEROIC analysts identified the GameGrin database as part of a credential stuffing compilation circulating on Telegram in October 2018. The breach exposed 90,373 records from the gaming news and review platform, with the data including email addresses, usernames, IP addresses, birthdays, and salted MD5 password hashes. What stood out to our team was the inclusion of birthday data alongside account credentials, which recieved particular attention from threat actors building targeted social engineering profiles against gaming community members.

Birthdays, IP Addresses, and Hashed Passwords Make GameGrin Users Easy Targets

With email addresses, usernames, IP addresses, and birthdays in hand, attackers can construct highly convincing phishing messages tailored to individual users. Birthday data is partcularly useful for bypassing security questions on banking and email platforms. The salted MD5 password hashes, while slightly more resistant than plain MD5, can still be cracked using modern GPU-accelerated tools, giving attackers plaintext credentials to test across gaming platforms, Steam, and email providers.

What Was Exposed in the GameGrin Breach

• Email Address
• Password Hash
• Username
• IP Address
• Birthday
• Salt

Why Gamers Are High-Value Targets After the GameGrin Breach

Gaming accounts often hold real monetary value through in-game currency, rare items, and linked payment methods. Attackers who obtain GameGrin credentials will attempt to use them against Steam, Epic Games, and other platforms where the same email and password combination might unlock an account worth hundreds of dollars. Credential stuffing attacks are occured at scale using automated bots, meaning even a modest dataset like this one enables thousands of login attempts per hour across multiple platforms.

How a Database Breach Works

A database breach occurs when an unauthorized party gains access to a web application's backend data store, typically by exploiting a vulnerability in the site's software or configuration. The attacker extracts user records in bulk and packages the data for sale or distribution. Gaming sites are frequent targets because they often store valuable account data without enterprise-grade security controls.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records to check whether your email appears in the GameGrin breach or any other known incident. Run your free scan now and find out if your gaming credentials are in circulation on criminal forums.