Gamers Beware: The Crims Breach Leaked 10K Accounts in 2016

HEROIC analysts discovered renewed activity around The Crims breach while scanning underground forums for recycled gaming account data. The breach occured in September 2016, exposing 10,379 user records from the online crime-simulation game. Despite the relatively small record count, our team found the dataset recieved fresh attention on dark web channels where attackers were cross-referencing it with other gaming platform leaks to build enriched target profiles. The presence of vBulletin password hashes in the dataset makes this seperate from breaches where no credentials were exposed at all.

How Hackers Use Gaming Account Data to Break Into Other Accounts

Gamers often reuse the same username and password combination across multiple platforms, from gaming sites to email accounts and even banking apps. When attackers get hold of vBulletin password hashes from The Crims breach, they can run cracking tools to recover the original passwords and then test those credentials against dozens of other services automatically. This is called credential stuffing, and gaming communities are partcularly targeted because of historically high password reuse rates. Even a small breach of 10,000 accounts can generate hundreds of successful account takeovers on higher-value platforms.

What Was Exposed in the The Crims Breach

• Usernames
• Email addresses
• vBulletin password hashes

Why Old Gaming Breaches Keep Showing Up in New Attacks

Attackers don't discard old breach data. They stockpile it and combine it with more recent leaks to build detailed user profiles over time. The Crims breach data is accessable on several dark web repositories, and our monitoring shows it being bundled with other gaming site leaks as part of credential stuffing packages. For anyone who registered at The Crims with an email and password they still use today, the risk of account takeover, identity theft, and financial fraud is very real, even nearly a decade after the original incident.

How Database Breaches Work

A database breach happens when an attacker gains unauthorized access to the backend systems where a website stores its user data. For sites running on vBulletin forum software, this often means exploiting known security vulnerabilities in older versions of the platform. Once inside, attackers extract the user database, which includes account details and password hashes. These hashes can later be cracked using specialized tools, turning a database dump into a working list of username and password pairs ready for use in attacks against other services.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against a database of over 400 billion compromised records, including data from The Crims breach and thousands of other gaming platform incidents. Run a free check now to see if your credentials are circulating and get clear steps to protect your accounts before attackers use them.