If You Used RuneScape in 2013, This 189,051-Record Leak Matters

The RuneScape Data Breach: What HEROIC Found

HEROIC analysts identified a breach tied to RuneScape (runescape.com), dated to August 14, 2013. The exposed dataset totals 189,051 records and includes IP addresses, password hash type metadata, email addresses, usernames, and passwords hashed with the vBulletin (vB) algorithm.

Why This Is Dangerous If You Played RuneScape

If you created a RuneScape-related account around 2013, this leak concerns you directly. vBulletin password hashes are outdated and can be cracked in bulk with modern hardware, and once cracked, the username and email pairs in this dataset become a working login list. Gaming accounts often carry real value, in-game items, subscriptions, and linked payment methods, which makes them a practical target, and any reused password extends the risk to your email or financial accounts too.

What Was Exposed in the RuneScape Leak

• IP addresses
• Password hash type metadata
• Email addresses
• Usernames
• Passwords (vBulletin hash format)

Why This Matters: Gaming Credentials Are a Real Target

Attackers actively trade and exploit gaming credentials because accounts often hold tradeable items, in-game currency, or linked purchase histories. Beyond the direct loss of an account, the bigger risk is credential stuffing: automated tools take the email and password pairs from breaches like this one and test them against banking, email, and social media logins, turning a single old gaming leak into a broader identity theft or financial fraud problem.

How a Database Breach Like This Happens

This incident is classified as a database breach, meaning the underlying user table was copied or extracted directly from the server, typically through a compromised system, an unpatched vulnerability, or a misconfiguration. That is different from a stealer log, which comes from malware on an individual's device. A database breach hits every account on the platform at once, which is why the same password hash format appears across the entire 189,051-record leak.

Check If You Are Affected

If you ever had a RuneScape-related account or reuse passwords across sites, it is worth checking your exposure now. HEROIC's free breach scanner checks your email address against more than 400 billion breached records, including this one, so you can find out in seconds whether you were affected.