League of Legends Forum Breach Exposes 148K Gamer Plaintext Passwords

HEROIC's DarkHive system discovered the League of Legends Forum breach, exposing 148,398 records in August 2018. This US-based fan community forum dedicated to the globally popular multiplayer online battle arena game suffered a database compromise that revealed member email addresses and plaintext passwords belonging to gamers from the League of Legends player community.

Why This Is Dangerous

Gaming forum breaches that expose plaintext passwords represent the most severe form of credential exposure, as passwords require no cracking and are immediately usable for account takeover across any platform where the same credentials were reused. The League of Legends player base is a prime target for gaming account theft, in-game currency fraud, and marketplace account hijacking given the game's extensive virtual item economy. Fan forum accounts often share credentials with official game accounts, Riot Games accounts, and connected gaming platforms, creating immediate account takeover risk.

What Was Exposed

• Email Address
• Plaintext Password

Why This Matters

Gamers whose League of Legends Forum credentials were exposed in plaintext face immediate account takeover risk on their Riot Games account, Steam, Discord, and any other platform where the same password was reused. Virtual item inventories and in-game currency represent real monetary value that criminals extract through account compromise, making gaming credential theft a high-reward criminal activity. Anyone who registered on this forum must immediately change their password on all platforms where those credentials were used.

How Database Breach Works

Gaming fan forums accumulate player registration data that mirrors the credentials used across the broader gaming ecosystem, making them high-value targets for credential theft operations targeting game account takeover. Attackers exploit forum software vulnerabilities in community platforms to extract user databases, with plaintext password storage meaning zero additional effort is required to weaponize the stolen credentials. These credentials are immediately deployed in automated account takeover attacks against official gaming platforms and item marketplaces.

Check If You Are Affected

HEROIC offers a free identity scanner searching over 400 billion records including data from the League of Legends Forum breach. Visit heroic.com to check if your information was exposed.