One Gaming Site. 16,102 Accounts. JusT2Play Exposed Hashed Passwords.

HEROIC analysts identified a verified data breach tied to JusT2Play, a Romanian gaming website, dating back to April 1, 2016. The exposure covers 16,102 user accounts associated with just2play.ro. Passwords in this breach were stored using the IPB hash format, a scheme commonly used by Invision Power Board forum software.

Why IPB Hashed Passwords From JusT2Play Are Still a Risk

The IPB hashing format is a legacy scheme that is far weaker than modern password hashing methods, and it can be cracked with widely available tools, especially for shorter or common passwords. Once cracked, a password recovered from this breach can be tried on other accounts if it was ever reused.

What We Know Was Exposed

• 16,102 user accounts tied to JusT2Play.ro
• Passwords hashed using the IPB format
• Breach date: April 1, 2016
• Other specific data fields were not individually categorized in this record

Why This Matters Even for an Old Gaming Site Breach

A breach tied to a gaming account might seem low stakes, but the real risk is password reuse. If the password behind one of these 16,102 accounts was ever cracked and matches a password you use on email, banking, or shopping accounts, an attacker gains a foothold well beyond the original gaming site, opening the door to credential stuffing and account takeover elsewhere.

How a Legacy Database Breach Like This Resurfaces

This incident stems from a direct compromise of JusT2Play's user database. Breaches like this one, involving older forum software and outdated hashing, often sit quietly for years before being repackaged and traded alongside other historical leaks on forums that deal in compromised data, which is why a 2016 breach is still worth checking today.

Check If You Are Affected

If you ever had an account on JusT2Play, it is worth checking whether you were part of this 16,102-record exposure. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, so you can catch old exposures like this one and update any reused passwords.