The Gamestop Leak: 139 Plaintext Passwords and Emails Exposed

HEROIC analysts identified a data breach tied to Gamestop, dated September 28, 2015. The breach exposed 139 records, each containing an email address and a password. The passwords were stored and exposed in plaintext, meaning they were never hashed or encrypted.

Why Plaintext Passwords From a Gamestop Account Are a Real Problem

A Gamestop account is often tied to more than just game purchases, it can be linked to saved payment methods, reward points, and pre-order history. Because these 139 passwords were stored in plaintext, anyone who obtains this data can read each password exactly as it was typed, with no cracking or guessing required. That removes the single biggest obstacle standing between a leaked credential and someone actually logging in.

What Was Exposed

• Email addresses
• Passwords, stored and exposed in plaintext

Why This Matters

If any of these 139 people used their Gamestop email and password anywhere else, that combination is now a working key to try against other accounts. This is exactly how credential stuffing works: attackers take verified email and password pairs and test them automatically across banking sites, email providers, and other shopping accounts. From there, account takeover, identity theft, and financial fraud all become real possibilities, especially since a plaintext password requires no extra work to use.

How This Database Breach Happened

This incident is classified as a database breach, meaning the records were extracted directly from stored account data rather than collected from individual devices. Storing passwords in plaintext instead of hashing them is considered a serious security failure on its own, since a single instance of unauthorized access instantly exposes every password in the affected records with no additional cracking needed.

Check If You Are Affected

If you have ever had a Gamestop account, it is worth checking whether your email and password were part of this exposure. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, giving you an instant answer so you can change any reused passwords before someone else uses them first.