The Gampeon Breach Contains Exactly 14,035 Names and Password Hashes

HEROIC analysts identified a dataset from Gampeon, a now-defunct German messaging platform, posted to a cybercrime forum. Discovered on June 4, 2022, the dataset contains 14,035 records, each including an email address, username, first name, last name, and a bcrypt password hash.

Why This Is Dangerous

Bcrypt is a strong hashing algorithm, which makes cracking these passwords far harder than breaches using MD5 or plaintext. Still, a weak or commonly used password can eventually be cracked even under bcrypt, and even without the password, an attacker already has a full name, username, and email address for each of the 14,035 people in this dataset.

What Was Exposed in the Gampeon Breach

• Email addresses
• Usernames
• First and last names
• Bcrypt password hashes

Why This Matters for the 14,035 People Affected

Even with strong password hashing, the combination of a real name, username, and email address is enough for attackers to run targeted phishing campaigns or attempt account recovery scams on other services. If a password is eventually cracked, the risk expands further into credential stuffing, account takeover, and identity theft on any account where that password was reused.

How This Database Breach Happened

This incident is classified as a database breach, meaning attackers obtained a direct copy of Gampeon's user records, likely through a vulnerability in the messaging platform's backend systems. The stolen data, including full names and bcrypt hashes, was then posted to a cybercrime forum where it remains available years after the platform itself shut down.

Check If You Are Affected

To find out if your email address or password appears in this leak or any other, run a free scan with HEROIC's breach checker, which searches a database of more than 400 billion leaked records.