The Newbville Breach Put 194K Stolen Email and Password Pairs Online in 2017

HEROIC analysts discovered the Newbville breach while scanning newly surfaced credential datasets linked to gaming-adjacent platforms. The breach occured in November 2017 and exposed 194,446 user records from this US-based platform where people bought and sold MMORPG accounts. The exposed data included email addresses and plaintext passwords, two pieces of information that are all an attacker needs to attempt logins on any other site where the victim uses the same credentials.

Why Gaming Platform Credentials Are a High-Value Target for Attackers

Gaming account marketplaces attract users who often have the same email and password across gaming services, social platforms, and personal email. When those credentials leak in plaintext, attackers do not just target the original gaming accounts. They use the same login pairs to access email inboxes, PayPal accounts, and any platform where the victim may have registered with the same password. The combination makes these breaches partcularly useful to criminals running large credential stuffing operations.

What Was Exposed in the Newbville Breach

• Email Address
• Plaintext Password

Why Nearly 200K Plaintext Passwords Still Matter in 2024

Passwords leaked in plaintext in 2017 remain fully functional on any account where the user never changed them. Attackers know this and actively recycle older breach data in credential stuffing campaigns aimed at financial accounts, streaming services, and corporate login portals. The result is account takeover that can lead to identity theft, unauthorized transactions, and access to sensitive personal or work-related information.

How a Database Breach Works

A database breach happens when an attacker gains unauthorized access to the data storage system behind a website. Platforms like Newbville held user account information in a database. If that database was not properly secured and the passwords were stored without encryption, an attacker who breaks in can extract the entire user list and walk away with hundreds of thousands of ready-to-use login credentials. The breach may go undetected for months while the stolen data spreads across underground markets.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against more than 400 billion records including the Newbville breach dataset. If your data appears in any known leak, you will know right away so you can change affected passwords and lock down your accounts before attackers get there first.