Researchers Link NetEase to 109 Million Exposed Accounts

HEROIC analysts have logged a database breach tied to NetEase, the Chinese technology company behind the 163.com email and gaming platform, in our breach intelligence tracking. This is one of the largest breaches in our records, covering 109,456,977 accounts, with a recorded leak date of October 19, 2015. The breach has not been independently verified, since confirming data tied to Chinese platforms is notoriously difficult, but the recorded password types for this dataset are plaintext and MD5.

Why the NetEase Breach Is Dangerous

A 163.com or NetEase email account often functions as a person's primary inbox, the account that receives password reset links for banking apps, shopping sites, and social media accounts elsewhere. If your email and password appear in this dataset, and that password was ever stored in plaintext or a weak MD5 hash, an attacker could potentially log directly into that inbox and use it to reset passwords on every other account tied to that email address.

What Was Exposed in the NetEase Breach

• Email addresses
• Passwords, recorded as either plaintext or MD5 depending on the account

Why the Scale of This Breach Matters

With over 109 million accounts involved, this is not a targeted incident, it is a mass exposure large enough to fuel credential stuffing campaigns across the internet for years. Attackers do not need to focus on any one person, they simply automate login attempts across thousands of websites using this list and collect whatever accounts happen to match. Given the size of the dataset, even a small success rate translates into an enormous number of compromised accounts elsewhere.

How a Breach of This Size Happens

This incident is classified as a database breach, meaning attackers obtained direct access to backend systems and extracted user records in bulk rather than gathering them individually. The mix of plaintext and MD5 password storage suggests inconsistent security practices across the platform's history, with some accounts left completely unprotected and others secured with an algorithm that is now considered weak and crackable at scale. Because the breach cannot be independently verified, HEROIC records it as unverified while still tracking it for exposure purposes, since multiple independent password matches have been reported by researchers checking their own credentials.

Check If You Were Affected by the NetEase Breach

Given the scale of this breach, checking your exposure is worthwhile whether or not you remember creating a NetEase or 163.com account. HEROIC's free breach scanner checks your email address against a database of more than 400 billion breached records, including this one, and shows you exactly where your information has surfaced. Run a free scan to see your exposure and change any passwords you may still be reusing.