Houdao.com Breach: 24.4M Gaming Accounts With Plaintext Passwords

HEROIC's DarkHive intelligence system uncovered the Houdao.com data breach, which exposed 24,398,505 user records from a gaming platform. The breach occured in March 2011 and compromised email addresses alongside plaintext passwords. The absence of any password hashing or encryption means every credential in the dataset was immediately usable by attackers, with no cracking effort required whatsoever.

Why This Is Dangerous

Plaintext password storage at this scale represents one of the most severe security failures a platform can commit. Thier 24 million users trusted the platform with their login credentials, and those credentials were stored as raw readable text. When attackers obtained the database, they possessed 24 million ready-to-use username and password pairs. These combinations are tested against email providers, banking apps, e-commerce platforms, and social networks in automated credential stuffing attacks that can compromise thousands of secondary accounts within hours.

What Was Exposed

• Email addresses
• Plaintext passwords

Why This Matters

Twenty-four million credential pairs is a substantial attack resource. Even a small fraction of users who reused their Houdao.com password elsewhere would represent hundreds of thousands of compromised accounts across the internet. The breach data has circulated in underground markets and dark web forums since 2011, meaning it has had over a decade of exposure. Seperate from the immediate risk in 2011, this data continues to appear in credential stuffing tool imports because the passwords remain valid for anyone who never changed them or used them on other services.

How Database Breaches Work

Gaming platforms store user credentials to authenticate returning players. When security practices are inadequate, the database holding these credentials becomes the most valuable target in the entire infrastructure. Attackers exploit web application vulnerabilities, unpatched software, or compromised hosting accounts to gain database access. Once inside, extracting all records from a user table takes minutes. The plaintext nature of Houdao.com's password storage meant there was no additional barrier between the breach and full credential exposure for all 24 million accounts.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records to determine whether your email address appeared in the Houdao.com breach or other known data incidents. If your credentials were part of this dataset, you may still be at risk if you used the same password on any other platform. Visit heroic.com to scan your identity free and take steps to update any shared passwords before attackers use them against you.