Account Takeover Got Easier Because of the Gametag Breach: 158K at Risk

HEROIC analysts identified the Gametag breach while scanning gaming-related data sets that have been recirculating through breach trading communities. The breach occured in July 2018 and exposed 158,375 users of Gametag, a now-defunct marketplace for buying and selling video game accounts including Xbox and MMO credentials. What made this breach recieved so much concern in the security community is that passwords were stored in plaintext, meaning no cracking or decoding was required for attackers to read them directly.

Why Plaintext Passwords Give Attackers Instant Access to Your Other Accounts

Most sites at least scramble passwords using a hashing algorithm, which creates a small barrier for attackers. Gametag did not do this. Every password in this breach was stored exactly as users typed it, making it immediately usable without any additional effort. If you used that same password on your email, Steam, PayPal, or any other service, attackers have had a readable copy of it since 2018. Credential stuffing tools can automatically test these passwords across hundreds of platforms within hours of obtaining a data set like this one.

What Was Exposed in the Gametag Breach

• Email Address
• Plaintext Password

Account Takeover Just Got Easier Because of the Gametag Breach

Plaintext passwords from any breach are among the most dangerous credential types in circulation. Attackers do not need to guess, crack, or brute-force anything. They have the exact password you chose. This makes account takeover attempts trivially easy, and the downstream consequences can include identity theft, unauthorized purchases, compromised email accounts used for further fraud, and loss of access to gaming platforms, financial services, and social media. Even if Gametag itself is long gone, the passwords it stored are still being used in active attack campaigns.

How a Database Breach Works

A database breach happens when the records a website stores about its users fall into the wrong hands. For a marketplace like Gametag, the user database contained account login information needed to authenticate users when they signed in. When that database was taken by unauthorized parties and eventually shared publicly, every record inside it became available to anyone who wanted it. The fact that Gametag stored passwords in plaintext meant there were no additional steps between an attacker getting the data and being able to use it.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records, including the Gametag data set. If your email address was part of this breach, you will see it instantly. Change your passwords on any account where you used the same credentials, and consider using a password manager to avoid reuse going forward.