How a 2018 Database Breach Exposed 6,583 ProLeague Accounts

HEROIC analysts identified a database breach affecting ProLeague, a German platform for the "Pro Clubs" mode in virtual football games. The breach is dated to August 26, 2018, and exposed 6,583 records, including email addresses and hashed passwords, which later surfaced on a hacking forum.

How the ProLeague Breach Puts Accounts at Risk

The passwords in this breach were not stored in plaintext, they were hashed. Hashing is meant to protect a password even if a database is stolen, but hashes can still be cracked, especially when the original password was short, common, or reused from another site. Once cracked, a password from this breach is just as usable as one that was never protected at all.

What Was Exposed in the ProLeague Breach

• Email addresses
• Password hashes

Why This Matters

Data from breaches like this one gets fed into credential stuffing tools, which try each cracked email and password combination against banking sites, email accounts, and social media. Anyone who reused their ProLeague password elsewhere is at risk of account takeover, identity theft, or financial fraud, even years after the original breach.

How a Database and Combolist Breach Happens

This incident is classified as a database and combolist breach. Attackers typically gain access to a company's user database directly, then repackage the stolen emails and password hashes into combolists that circulate on hacking forums, where they can sit for years before being picked up and reused in new attacks.

Check If You Are Affected

Use HEROIC's free breach scanner to see if your email appears in the ProLeague breach or any other leak. It checks your information against a database of more than 400 billion leaked records so you can act if you need to.