The IDC Games Breach Put 3.9 Million Stolen Email and Password Hash Records Online in 2021

HEROIC analysts recieved intelligence in March 2021 pointing to a significant database breach at IDC Games, a free-to-play gaming platform based in Spain. The breach exposed 3,955,649 user records containing email addresses, usernames, IP addresses, password hashes, and salts. Passwords were stored using MD5 with salt, an outdated hashing method that modern cracking tools can defeat with relative ease.

Why Cracked MD5 Hashes Put IDC Games Users at Risk

Attackers who obtain salted MD5 hashes can run them through GPU-accelerated cracking tools and recover plaintext passwords partcularly quickly compared to stronger algorithms. Once a password is recovered, it can be tested across email providers, banking portals, and other gaming platforms through credential stuffing, putting accounts the victim uses elsewhere in immediate danger.

What Was Exposed in the IDC Games Breach

• Email Address
• Username
• IP Address
• Password Hash
• Salt

Why the IDC Games Breach Still Matters Years Later

Breached data does not expire. The IDC Games records first occured in March 2021 and have continued to circulate on hacking forums, giving attackers repeated opportunities to attempt credential stuffing, account takeover, and identity verification attacks. Users who have not changed their passwords since 2021 remain at elevated risk today.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to a backend database, typically by exploiting a vulnerability in a web application, using stolen credentials, or leveraging misconfigured server permissions. Once inside, the attacker exports user records in bulk. The stolen data is then packaged and sold or shared on dark web forums, often within days of the intrusion.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records, including the IDC Games database, to tell you whether your email address or credentials appear in known breach data. Run a free check now to find out if your information is accessable to attackers.