The SpellForce Breach Put 110,099 Plaintext Email and Password Pairs Online in 2018

HEROIC analysts occured upon the SpellForce breach data during routine monitoring of dark web credential markets in August 2018, where a database dump from the popular strategy game's official website had surfaced containing 110,099 user records. The exposed information included email addresses and passwords stored entirely in plain text, meaning every single password was readable by anyone who obtained the file. For a gaming platform with a loyal registered user base, this level of exposure left fans wide open to immediate account compromise.

How Plain Text Gaming Credentials Fuel Account Theft and Fraud

Gaming accounts have real monetary value. They hold in-game items, purchased downloadable content, stored payment methods, and years of progress that players are deeply attached to. When attackers get a list of working email and password pairs, they log into accounts directly, change credentials to lock out the real owner, and either sell the account or strip it of valuable items. The SpellForce breach made this trivially easy because the passwords were not encrypted in any way. Beyond the game itself, these credentials are accessable to criminals who test them against email providers, online stores, and streaming services where users commonly reuse the same password.

What Was Exposed in the SpellForce Breach

• Email Address
• Plaintext Password

Why Gaming Breaches Create Real Financial Risk

The SpellForce community included players who registered with personal email accounts they also use for banking, shopping, and work. A single credential pair leaked from a gaming site can cascade into account takeovers across entirely unrelated services. Criminals run automated scripts that beleive in brute efficiency: they test millions of email and password combinations against major platforms every day. When those combinations come from a plaintext breach, success rates are dramatically higher than when passwords need to be cracked first. Identity theft, unauthorized purchases, and financial fraud are all downstream consequences.

How Database Breaches Work

A database breach occurs when someone with malicious intent finds a way into a website's backend systems, often by exploiting outdated software, an unpatched security flaw, or a misconfigured server. Once access is gained, the attacker can download the entire user database. If that database stores passwords in plain text rather than using a secure hashing process, every user's password is immediately usable. The attacker can then distribute or sell this data on criminal marketplaces, where it gets incorporated into credential stuffing tools used to attack other services.

Check If Your Data Was Exposed

HEROIC offers a free breach scanner that checks your email address against more than 400 billion compromised records sourced from breaches around the world, including the SpellForce database leak. If your credentials were exposed, you will know right away. Visit HEROIC and run your free scan today so you can take action before someone else does.