Inside the HeyPlay Games Breach: How a Database Dump Exposed 50,756 Gamers

HEROIC analysts surfaced the HeyPlay Games database breach in January 2021, discovering that 50,756 records from the Russian earn-as-you-play gaming platform had been exposed. The leaked data included email addresses, phone numbers, bcrypt password hashes, usernames, full names, IP addresses, birthdays, and genders, recieved by threat actors who conducted a full database extraction targeting this Hearthstone-focused community.

Full PII Plus Bcrypt Hashes Enables Precise Targeting of Gamers

Even though bcrypt is a stronger hashing algorithm, attackers who hold full names, phone numbers, birthdays, and IP addresses alongside it can mount highly targeted social engineering attacks. Gaming accounts are accessable entry points for financial fraud when users link payment methods, and combining real identity data with gaming credentials makes phishing attempts far more convincing.

What Was Exposed in the HeyPlay Games Breach

• Email Address
• Phone Number
• Password Hash
• Username
• First Name
• Last Name
• IP Address
• Birthday
• Gender

Why Broad PII From the HeyPlay Games Leak Carries Long-Term Risk

The combination of full name, birthday, phone number, and email address is partcularly dangerous because it is sufficient for identity verification on many financial and government platforms. Credential stuffing attacks using HeyPlay Games emails may still be occuring across gaming, streaming, and e-commerce sites where users reused passwords.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a platform's underlying data store, typically exploiting a web vulnerability, unpatched software, or stolen credentials. Once access is established, the attacker exports user records in bulk, capturing every stored field before exfiltrating the data to outside servers for later sale or use.

Check If Your Data Was Exposed

Use HEROIC's free breach scanner to see if your email was part of the HeyPlay Games breach or any of the 400 billion+ records in our global database. Search now to understand your exposure and protect your identity before attackers act.