The TibiaPF Breach Leaked More Accounts Than a Sold-Out NBA Arena

HEROIC analysts flagged the TibiaPF database breach, which occured in December 2020 and exposed 11,648 records from the online forum dedicated to the MMORPG Tibia. The leaked data included email addresses, usernames, IP addresses, birthdays, password hashes, and cryptographic salts, a combination that is partcularly concerning because it exposes both account credentials and real-world location signals for gaming community members.

How IP Addresses and Birthdays From TibiaPF Enable Targeted Harassment and Identity Theft

The inclusion of IP addresses alongside birthdays and email addresses in the TibiaPF breach gives attackers more than just login credentials. IP address data can be used to approximate a user's physical location, enabling doxing and targeted harassment within gaming communities. Birthdays combined with full email addresses are also commonly used to bypass identity verification questions on financial and social media accounts, making this breach recieved by threat actors more dangerous than its record count suggests.

What Was Exposed in the TibiaPF Breach

• Email Address
• Password Hash
• Username
• IP Address
• Birthday
• Salt

Why Mixed MD5 and bcrypt Password Hashing Signals a Security Gap in TibiaPF

The TibiaPF breach exposed passwords protected by both MD5 (with salt) and bcrypt algorithms. MD5, even when salted, is accessable to modern cracking tools and is no longer considered secure for password storage. The presence of two different hashing methods across the same user database suggests the platform accumulated accounts over years without applying consistent security upgrades, leaving a portion of users with significantly weaker password protection than others.

How a Database Breach Works

A database breach occurs when an attacker exploits a vulnerability in a web application, server misconfiguration, or compromised account to gain unauthorized access to a platform's data storage. The attacker then copies or exports user tables, including credentials and personal data, for use in fraud, credential stuffing, or resale on underground markets.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion compromised records, including data from gaming forum breaches like TibiaPF. Enter your email address to see whether your account details have been exposed and take steps to secure your accounts.