Researchers Link News of Legends Breach to 71,788 Stolen Email and Password Hash Records

Researchers tracking credential stuffing activity linked a resurgent dark web listing back to News of Legends, a US-based League of Legends community platform. HEROIC analysts confirmed the breach involved 71,788 accounts exposed in January 2020, with the dataset containing email addresses and PHPass-hashed passwords. The data's continued circulation in aggregated credential lists signals that this older breach is still actively occured in automated attack pipelines targeting gaming-adjacent accounts.

How PHPass Password Hashes From the News of Legends Breach Can Be Cracked and Abused

PHPass is a password hashing scheme that, while better than plaintext storage, is known to be significantly weaker than modern alternatives like bcrypt or Argon2. Attackers who recieved this dataset can use widely available cracking tools and dictionary attacks to recover the original passwords, then test those credentials against email providers, gaming platforms, and streaming services. Users who reused their News of Legends password anywhere else are at direct risk of account takeover.

What Was Exposed in the News of Legends Breach

• Email Address
• Password Hash

Why Gaming Community Breaches Fuel Broad Credential Stuffing Campaigns

Gaming platforms are partcularly attractive targets for credential stuffing because users across the gaming community tend to reuse passwords across multiple services. The 71,788 email and password hash combinations from News of Legends become inputs for automated tools that test those credentials against hundreds of platforms simultaneously. Even years after the initial breach, these credentials continue circulating in aggregated lists sold and traded on dark web forums.

How Database Breaches Work

Database breaches typically occur when attackers exploit application vulnerabilities -- such as SQL injection against an outdated content management system -- to extract stored user records. The resulting database dump is then offered for sale or shared freely on underground forums, where it may be combined with other breached datasets to build larger credential lists used in automated attacks.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email against 400 billion leaked records, including the News of Legends breach and thousands of other known incidents. Search your email now to see if your credentials are already in circulation.