Global Runescape

We've been tracking a resurgence of older breach datasets appearing on underground forums, often repackaged and sold as "new" leads. What caught our attention wasn't the age of this particular Global Runescape breach from 2015, but its unexpectedly high success rate in recent credential stuffing attacks against gaming platforms and cryptocurrency exchanges. The relative simplicity of the hashed passwords, combined with widespread password reuse, is making this old data relevant again.

Global Runescape Forum Breach: 10,231 Accounts Resurfacing

A database breach impacting the Global Runescape forum, dating back to January 25, 2015, has resurfaced in multiple online breach collections. The breach was initially reported at the time, but its recent reappearance and observed use in credential stuffing attacks warranted a closer look. What makes this breach noteworthy is the continued viability of the leaked credentials, likely due to poor password hygiene among users and the relatively weak hashing algorithms employed at the time.

The compromised data was discovered circulating on a popular hacking forum on October 26, 2023, being offered for sale as a "fresh" database. Further investigation revealed that this was, in fact, the 2015 Global Runescape breach. The data's reappearance coincides with a spike in reports of unauthorized access attempts across several gaming and cryptocurrency platforms, suggesting the breached credentials are actively being used for account takeovers.

This breach highlights the long tail of security incidents. Even older breaches can pose a significant risk if the exposed credentials remain valid. The gaming community is frequently targeted by attackers due to the potential for financial gain through the sale of in-game items or compromised accounts. The re-emergence of this Global Runescape data underscores the importance of proactive password resets and the implementation of multi-factor authentication, even on older accounts.

• Total accounts exposed: 10,231
• Data types included: Email addresses, usernames, passwords (hashed), IP addresses
• Sensitive content types: Potentially identifiable information (PII)
• Source structure: Database dump
• Leak location(s): Hacking forums
• Date of first appearance: January 25, 2015; Reappeared October 26, 2023

Security researcher Troy Hunt added the breach to HaveIBeenPwned on January 26, 2015, confirming the validity of the data. He noted that the passwords were weakly hashed, making them susceptible to cracking. "The passwords were only hashed with salted MD5, making them relatively easy to crack," Hunt stated in his description of the breach on his website. This detail explains the continued efficacy of the credentials in modern attacks.