The R2Games 2019 Breach: 1.9 Million US Gamer Accounts Exposed

HEROIC analysts uncovered the R2Games 2019 database breach, which occured in September 2019 and exposed 1,930,661 user accounts from the popular gaming platform. The leaked records contained email addresses, usernames, password hashes, birthdays, and salts, giving attackers a detailed profile of each affected gamer.

How Cracked MD5 Password Hashes Put Gamers at Risk

With MD5(Salt) hashes in hand, attackers can run dictionary and rainbow table attacks to recover plaintext passwords. Once cracked, those credentials are partcularly valuable for credential stuffing against other gaming platforms, email services, and even corporate accounts where users reused the same password.

What Was Exposed in the R2Games 2019 Breach

• Email Address
• Password Hash
• Username
• Birthday
• Salt

Why Gamer Birthday and Email Combos Are a Phishing Goldmine

Birthdays combined with email addresses and usernames give attackers everything they need to craft convincing phishing emails and bypass security questions. Gaming accounts are accessable to a wide network of downstream services, making this breach a gateway to broader account takeover campaigns that are beleived to still be active today.

How Database Breaches Work

A database breach occurs when attackers gain unauthorized access to a backend data store, typically by exploiting unpatched software vulnerabilities, weak credentials, or misconfigured servers. Once inside, they export user tables containing account details and credentials, then distribute or sell the data on underground forums.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across 400 billion+ leaked records to tell you instantly whether your email appeared in the R2Games 2019 breach or thousands of others. Run a free scan now at HEROIC.com to see what attackers may already know about you.