Armor Games Data Breach Exposes 10.6 M User Accounts and Password Hashes
What Happened — In January 2019 the Armor Games portal suffered a breach that released 10,604,307 user records. The exposed data include email addresses, usernames, IP addresses, dates of birth, gender, geographic location, and passwords stored as salted SHA‑1 hashes.
Why It Matters for Trust & Control Assurance
- Highlights the risk of weak password‑hashing algorithms and the need for robust credential‑protection controls.
- Underscores the importance of continuous monitoring of credential exposure and rapid evidence collection for audit readiness.
- Demonstrates why a documented access‑control program (including MFA, password‑policy enforcement, and logging) is essential to defend against large‑scale data exfiltration.
Who Is Affected – Online gaming and entertainment platforms that manage large user bases and store credential data.
Recommended Actions – Review and upgrade password‑storage mechanisms (e.g., migrate to bcrypt/Argon2), enforce multi‑factor authentication, implement continuous credential‑monitoring alerts, and gather evidence of these controls for audit purposes. Source: [HIBP breach record]
Technical Notes – The breach disclosed salted SHA‑1 password hashes, a legacy algorithm considered weak against modern cracking techniques. Other personal identifiers (DOB, IP, location) were also leaked. Source: [HIBP breach record]