PokeMiner

We've been tracking an uptick in scraped data targeting niche gaming communities, and a recent incident involving the mobile game companion app **PokeMiner** caught our attention. While the overall volume of records wasn't massive compared to some breaches we've seen, the highly specific targeting of Pokémon Go players and the nature of the exposed data – including precise location information – raised immediate concerns. The data had been circulating on a relatively obscure forum for several weeks, but we noticed a spike in activity and mentions across associated Discord servers, prompting a deeper investigation. What struck us wasn't just the presence of email addresses and hashed passwords; it was the inclusion of detailed in-app activity logs and GPS coordinates that painted a clear picture of users' real-world movements.

### The PokeMiner Leak: 5.7 Million Records Expose Player Locations and Game Activity

A breach impacting the mobile game companion app **PokeMiner** has resulted in the exposure of approximately 5.7 million user records. The data, discovered on a private forum frequented by data brokers, includes a concerning level of detail about users' gameplay and real-world locations. The initial discovery was triggered by increased chatter on associated Discord channels on October 26, 2023. The contents of the leak suggest a targeted scraping operation aimed at collecting user data from the app's API.

The significance of this breach lies in the sensitivity of the exposed data. While email addresses and hashed passwords were included, the real threat stems from the inclusion of detailed in-app activity logs and GPS coordinates. This information could be used to track players' movements, identify their home addresses or frequented locations, and potentially expose them to real-world risks. The leak highlights the dangers of collecting and storing granular location data, particularly within applications targeting younger audiences.

This incident contributes to a broader threat landscape where gaming-related data is increasingly targeted for malicious purposes. The automation of data scraping and the ease with which this data can be disseminated on online forums exacerbate the risk. The breach underscores the need for robust data protection measures within gaming applications and a heightened awareness of the potential consequences of sharing location data.

Breach Stats:
* Total records exposed: **5.7 million**
* Types of data included: Emails, usernames, hashed passwords, in-app activity logs, GPS coordinates.
* Sensitive content types: Precise location data, potentially identifying information.
* Source structure: JSON dump from API responses.
* Leak location(s): Private forum (name withheld for security reasons).

External Context & Supporting Evidence:

While no major news outlets have yet reported on this specific incident, similar breaches involving gaming data and location tracking have garnered significant attention. For example, in 2016, a data breach at the Pokémon Go app exposed user Google account information, raising concerns about privacy and security. The PokeMiner breach builds upon this history, demonstrating the continued vulnerability of gaming-related data.

Discussions on relevant subreddits (e.g., r/PokemonGo) indicate a growing awareness among players regarding the risks of using third-party apps and the potential for data breaches. One Reddit user commented, "I always knew these tracker apps were risky. Never worth giving away your info."

The scraping techniques used in the PokeMiner breach likely leveraged publicly available APIs and automated scripts, similar to those documented in various open-source repositories on GitHub. These tools enable attackers to efficiently collect data from vulnerable applications and services.