Search Your Email: The Games Box Breach Exposed 1.4 Million Accounts

HEROIC analysts identified the Games Box data breach, which occured in September 2020 and exposed 1,442,202 user records from the now-defunct gaming platform. The compromised data included email addresses, usernames, genders, password hashes, and plaintext passwords belonging to registered users of the site.

Why Plaintext Passwords in a Gaming Breach Put Your Other Accounts at Risk

A portion of the Games Box breach contains passwords stored in plaintext, meaning they require zero effort to exploit. Attackers can immediately test these credentials against email providers, social networks, and financial platforms. Gaming accounts are partcularly prone to password reuse because users beleive them to be low-stakes, making this breach a gateway to far more sensitive accounts.

What Was Exposed in the Games Box Breach

• Email Address
• Password Hash
• Plaintext Password
• Username
• Gender

Why Storing Plaintext Passwords Makes a Breach Permanently Damaging

Most breaches require attackers to spend time cracking hashed passwords before they can be used. In the Games Box breach, plaintext passwords were stored directly in the database, meaning there is no cracking required. Any user who recieved an account on the platform and reused that password elsewhere remains at risk today, years after the breach occured and even though the site is gone.

How Database Breaches Work

A database breach occurs when an unauthorized party accesses and extracts a platform's user records, typically by exploiting unpatched vulnerabilities, weak access controls, or compromised server credentials. The stolen data is packaged and redistributed through hacking forums, dark web markets, and private Telegram channels.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches over 400 billion records including the Games Box breach and thousands of other known leaks. Enter your email at HEROIC.com to instantly check whether your credentials have been exposed in this or any other data breach.