The WEBZEN Breach Means Someone Could Be Logging Into Your Accounts

If you had a WEBZEN forum account back in 2022, there is a real chance your email address, username, IP address, date of birth, and bcrypt password hash were recieved by attackers and are still circulating in credential stuffing lists today. The WEBZEN breach exposed 208,893 accounts from the South Korean MMORPG gaming platform, and the data continues to surface in underground communities years after the initial leak.

The WEBZEN Breach Means Someone Could Be Logging Into Your Accounts

Attackers who acquire gaming forum credentials do not stop at the game itself. They run the leaked email and password combinations through automated tools that test dozens of other platforms, including email providers, banking apps, and social networks. If you used the same password from your WEBZEN account anywhere else, those accounts are accessable to anyone who has bought or downloaded this dataset. The inclusion of usernames and IP addresses also allows attackers to correlate identities across platforms.

What Was Exposed in the WEBZEN Breach

• Email Address
• Username
• IP Address
• Birthday
• Password Hash (bcrypt)

Why the WEBZEN Breach Is Still Actively Exploited

Although bcrypt is a strong hashing algorithm, older bcrypt hashes with low cost factors can be cracked over time with sufficient compute power. The WEBZEN breach occured in January 2022, giving attackers over three years to work on the hashes. The data has been spotted in aggregated credential stuffing lists and mentioned on multiple underground forums as still yielding valid logins, meaning a meaningful percentage of affected users have never changed their passwords.

How a Database Breach Works

A database breach against a gaming platform typically begins with exploitation of a web application vulnerability, SQL injection, or compromised admin credentials. Once an attacker reaches the user database, they extract the full table containing account details and export it off the server. The dump is then shared or sold, and automated tools immediately begin testing the credentials against other services. Gaming platforms are high-value targets because players tend to use consistent usernames and passwords across games and related services.

Check If Your Data Was Exposed

HEROIC's identity monitoring platform indexes over 400 billion records from thousands of known breaches, including the WEBZEN database. Search your email address now to see if your gaming account credentials are already in circulation and get instant alerts if your information appears in future leaks.