288K HTH Studios Breach: Names and Passwords Exposed

HEROIC analysts discovered that a database breach at HTH Studios, a United States-based gaming company, occurred in August 2018 and exposed 288,174 user records. The compromised data includes email addresses, phone numbers, usernames, first and last names, IP addresses, birthdays, and password hashes stored using outdated SHA1 and MD5 algorithms. The combination of personal details and weakly protected passwords makes this a particularly serious incident, as it provides attackers with everything they need to target victims across multiple platforms.

How Your Phone Number, Birthday, and Hashed Password Create a Perfect Attack Profile

The HTH Studios breach is more dangerous than a typical password leak because attackers received a full profile on each victim. With a real name, email, phone number, and birthday in hand, an attacker can convincingly impersonate you when calling a bank or mobile carrier to request an account change. The MD5 and SHA1 password hashes included in the breach are also relatively easy to crack with modern computers, meaning the original passwords can often be recovered and tested against your other accounts. This combination of personal identifiers and crackable passwords creates a powerful toolkit for fraud.

What Was Exposed in the HTH Studios Breach

• Email Address
• Phone Number
• Password Hash
• Username
• First Name
• Last Name
• IP Address
• Birthday

Why the HTH Studios Breach Is a Gateway to Identity Theft and Financial Fraud

When attackers hold your full name, birthday, email, and phone number together, they have most of what they need to open fraudulent lines of credit, take over existing accounts, or pass identity verification checks. Credential stuffing attacks using the cracked passwords can compromise your email, from which attackers can reset passwords for banking and investment accounts. Social engineering attacks using your real personal details can fool customer service teams at your bank or phone provider. The cascading risk from this single breach extends far beyond the original gaming platform where the data was stored.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a company's stored data, often by exploiting a software vulnerability or using stolen administrative credentials. Once inside, the attacker can export the entire database silently. The use of outdated hashing algorithms like MD5 and SHA1 for passwords compounds the damage, because these algorithms are fast to compute and can be reversed using modern cracking tools and precomputed lookup tables. Companies using stronger modern algorithms make this process much harder for attackers, buying critical time and often making the cracked passwords useless.

Check If Your Data Was Exposed

If you ever had an account with HTH Studios, your personal information and password hash may already be circulating in underground markets. HEROIC's free breach scanner checks across more than 400 billion exposed records to tell you exactly what information of yours has been compromised. Run a free scan now and take action before attackers do.