Researchers Flag Stronghold Kingdoms: 4.8 Million Accounts Breached

HEROIC analysts uncovered the Stronghold Kingdoms breach while monitoring underground forums in July 2018. The incident affected 4,793,398 accounts on the massively multiplayer online strategy game, exposing usernames, email addresses, password salts, and salted SHA-1 password hashes. While SHA-1 with unique salts provides some protection, this hashing method is considered outdated and vulnerable to modern cracking techniques. The breach occured at a time when gaming platforms were being actively targeted by attackers looking for large sets of reusable credentials.

How Leaked Gaming Credentials Become a Gateway to Other Accounts

Gaming platforms are a prime target precisely because players tend to use the same email and password combination across many services. An attacker who cracks a Stronghold Kingdoms password can then try it against email providers, social media, and even online banking. With nearly 5 million accounts exposed, criminals had a large pool of credentials to test. SHA-1 hashing, even when salted, is no longer considered secure against well-resourced attackers, which means a significant portion of these passwords may now be known to people who should not have them.

What Was Exposed in the Stronghold Kingdoms Breach

• Email Address
• Username
• Salt
• Password Hash

Why Gaming Breaches Carry Risks Far Beyond the Game

The Stronghold Kingdoms breach matters even to people who never played the game. Attackers use credential stuffing tools to automatically test leaked email and password pairs against hundreds of websites. A single compromised gaming account can become the key that unlocks a bank account, a work email, or a cloud storage drive. Account takeover, identity theft, and financial fraud are all realistic outcomes when millions of username and password pairs circulate freely in criminal markets for years after a breach.

How Database Breaches Work

A database breach happens when an attacker exploits a security flaw in a website or its server to gain unauthorized access to the system that stores user records. Once inside, they can download the entire user database. The stolen information is then posted to dark web forums or sold to other criminals. The process can take only minutes, and the affected organization may not discover the intrusion for a long time afterward.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records to tell you whether your email or password appeared in the Stronghold Kingdoms breach or any other known data leak. Run a free scan now and find out whether criminals already have your information.