Clash of Kings Forum Breach Exposes 1.6 Million User Credentials and IP Addresses
What Happened — In July 2016 the online forum for the game Clash of Kings was compromised, leaking 1,604,957 user records. Exposed data included usernames, email addresses, IP addresses and passwords stored as unsalted MD5 hashes. The breach details were disclosed via Have I Been Pwned, sourced from dehashed.com.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential storage – a control‑area that continuous assurance programs must monitor and evidence.
- Highlights the need for robust authentication controls (strong hashing, salting, MFA) to satisfy multiple framework objectives in a single control.
- Provides a real‑world example where lack of proper credential protection can trigger regulatory scrutiny and damage trust.
Who Is Affected – Gaming platforms, online community forums, and any SaaS service handling user credentials.
Recommended Actions
- Replace MD5 hashes with salted, computationally‑hard algorithms (e.g., bcrypt, Argon2).
- Enforce MFA for all user accounts where feasible.
- Conduct a credential‑storage audit and map findings to your control‑assurance framework.
- Implement continuous monitoring for credential exposure and maintain a defensible audit trail.
Source: Have I Been Pwned – Clash of Kings breach
Technical Notes
- Attack vector unknown; breach likely stemmed from inadequate password hashing and possible server compromise.
- Passwords were stored as raw MD5 hashes without salting, making them trivially crackable.
- Data types exposed: email addresses, IP addresses, usernames, password hashes.
Source: Same as above