Identity Theft Risk: Go Games 2015 Breach Exposed 3.4 Million Accounts

HEROIC analysts have logged a database breach tied to Go Games 2015, a gaming platform previously operating at gogames.me, as part of our ongoing breach intelligence tracking. This is one of the larger breaches in our records, exposing 3,425,669 accounts, with a recorded leak date of October 24, 2015. The exposed data includes email addresses, usernames, IP addresses, salt values, and password hashes protected with salted MD5.

Why the Go Games 2015 Breach Is Dangerous

Salted MD5 was designed to make password cracking harder, but it is no longer considered strong protection by today's standards. With enough computing power, and MD5 is fast to compute, attackers can crack large batches of salted hashes in bulk rather than one at a time. At a scale of 3.4 million accounts, even a modest cracking success rate hands attackers hundreds of thousands of working email and password pairs, which they can then try against other websites where the same login was reused.

What Was Exposed in the Go Games 2015 Database

• Email addresses
• Usernames
• IP addresses
• Salt values used in password hashing
• Password hashes, protected with salted MD5

Why This Matters for 3.4 Million Former Go Games Users

At this scale, the breach becomes a resource for automated attacks rather than a targeted one. Cybercriminals load lists like this into scripts that test each email and cracked password combination against major email providers, banking sites, and social media platforms, a technique known as credential stuffing. Because IP addresses were also exposed, attackers can build a more complete picture of a person's location and online habits, which increases the risk of identity theft and makes phishing attempts feel more convincing and personal.

How a Salted MD5 Database Breach Works

This incident is classified as a database breach, meaning attackers accessed the Go Games backend directly and extracted the full user table rather than collecting credentials individually. The presence of salt values alongside the password hashes tells us the site was using a technique meant to make each password hash unique, even for users with identical passwords. That said, salted MD5 hashing is now considered weak because modern hardware can compute billions of MD5 hashes per second, making large-scale cracking practical for anyone with the right tools and enough patience.

Check If You Were Affected by the Go Games 2015 Breach

With 3.4 million accounts involved, the odds that your information is part of this breach are meaningfully higher if you ever registered on a gaming site around 2015. HEROIC's free breach scanner checks your email address against a database of more than 400 billion breached records, including this one, and shows you exactly where your data has surfaced. Run a free scan today to find out if you need to update any reused passwords.