Plaintext Passwords in the Wild: The Psyonix Data Breach

HEROIC analysts found that the Psyonix database breach, publicly disclosed on July 1, 2024, contained passwords stored in plaintext, an immediately actionable finding that separates this incident from the typical hashed-credential leak. When passwords are stored in plaintext, there is no cracking step required: attackers retrieve the password exactly as the user typed it. Combined with the email addresses also present in this dataset, the result is 1,003,495 ready-to-use credential pairs covering accounts tied to the Psyonix gaming platform, developer of the globally popular title Rocket League.

Why This Is Dangerous

Plaintext password storage is one of the most severe security failures a platform can commit. Unlike hashed passwords that require additional processing before they can be weaponized, plaintext credentials are immediately usable. Attackers can feed them directly into credential stuffing tools that test the email-and-password pairs across hundreds of other platforms simultaneously. With over one million accounts exposed, the volume alone ensures that a meaningful fraction will grant access to banking, email, or social media accounts where victims reused the same password.

What Was Exposed

• Email addresses
• Plaintext passwords

Why This Matters

Credential stuffing attacks driven by plaintext password leaks are among the leading causes of account takeover fraud. Once an attacker controls an email account, they can reset passwords across every linked service, effectively cascading a single breach into a full identity compromise. Gaming accounts tied to platforms like Psyonix frequently hold stored payment methods, linked Epic Games credentials, and in-game assets with real monetary value, making them priority targets beyond simple data theft. Identity theft and financial fraud are direct downstream consequences when this type of dataset circulates on criminal markets.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to a backend data store containing user records. Common attack vectors include exploitation of unpatched application vulnerabilities, SQL injection, compromised administrative accounts, and insecure third-party integrations. When the underlying database stores passwords in plaintext rather than using a secure hashing algorithm, the breach severity escalates from a credential compromise to an immediate, zero-step threat. The stolen data is then packaged and posted to hacking forums, where it is downloaded by multiple actors and used in automated attack campaigns.

Check If You Are Affected

HEROIC provides a free identity scanner that searches across more than 400 billion compromised records, including gaming platform breaches and plaintext credential databases. If you have ever held a Psyonix account or used the same password across multiple services, run a free scan at heroic.com now and change any reused passwords immediately.