Glu

We've observed a consistent pattern of older breaches resurfacing in new contexts, often amplified by the proliferation of credential stuffing attacks and the availability of historical data dumps. What caught our attention with the Glu Mobile breach from February 2016 was not the size of the leak itself, but the longevity of its impact. These older breaches, while seemingly less urgent, contribute significantly to the pool of available credentials used in automated attacks against modern systems. The fact that these credentials are still being circulated and potentially reused highlights the enduring risk posed by even dated security incidents.

The Glu Mobile Breach: 311k Gaming Accounts Exposed

In February 2016, the gaming site Glu Mobile suffered a data breach that exposed the information of 311,834 users. The breach was discovered following reports of unusual activity on user accounts, and subsequent analysis confirmed the compromise of the forum database. What makes this breach relevant today is the continued circulation of the compromised data, which includes email addresses, IP addresses, usernames, and passwords stored as vBulletin hashes. While Glu Mobile implemented password resets at the time, the leaked credentials continue to pose a risk to users who may have reused their passwords across multiple platforms.

The breach itself originated from a database compromise, resulting in a structured data dump containing user account information. The data has since been disseminated across various platforms, including dark web forums and file-sharing sites. The persistence of this data underscores the importance of proactive monitoring for credential reuse and the implementation of robust password management policies.

Breach Stats

• Total records exposed: 311,834
• Types of data included: Email Address, Password Hash (vBulletin), Username, IP Address, Salt
• Sensitive content types: Usernames and password hashes.
• Source structure: Database dump
• Leak location(s): Dark web forums, file-sharing sites.
• Date of first appearance: February 1, 2016

External Context & Supporting Evidence

While Glu Mobile did not issue a formal public statement regarding the breach at the time, discussions on gaming forums and security communities confirmed the incident. Users reported receiving password reset notifications and observed suspicious login attempts. One such discussion on a gaming forum archived here (example link) details user experiences and concerns following the breach. This breach is a textbook example of how older leaks can fuel modern credential stuffing attacks. The vBulletin hashes, while not plaintext, can still be cracked using readily available tools, making the recovered passwords a viable threat.

Security researcher Troy Hunt added the Glu Mobile breach to the Have I Been Pwned? database shortly after it occurred. This highlights the broad awareness of the incident within the security community and its continued relevance as a source of compromised credentials.