DLH.net Gaming News Site Breach Exposes 3.3 M Subscriber Identities and Steam Activation Keys
What Happened – In July 2016 the DLH.net gaming news platform was compromised, leaking 3,264,710 subscriber records. The disclosed data set contains email addresses, names, dates of birth, usernames, salted MD5 password hashes, and the keys used to redeem and activate games on the Steam platform. The breach details were later published on Have I Been Pwned by the monitoring service Vigilante.pw.
Why It Matters for Trust & Control Assurance
- The incident reveals a gap in credential‑storage controls (weak MD5 hashing) that a continuous‑control‑assurance program should detect, remediate, and retain evidence for.
- Demonstrates the need for auditable password‑policy enforcement (e.g., strong hashing, MFA) to satisfy multiple framework requirements with a single control objective.
- Highlights the importance of ongoing third‑party monitoring and evidence collection to prove due‑diligence when a breach surfaces.
Who Is Affected – Media & entertainment sites that manage large subscriber bases; any online service that stores user credentials and third‑party activation keys.
Recommended Actions
- Replace MD5 hashes with an adaptive algorithm such as bcrypt or Argon2 and re‑hash existing passwords.
- Enforce multi‑factor authentication for all user accounts.
- Conduct a credential‑storage audit, capture evidence of hashing standards, and map findings to your control‑assurance framework.
Technical Notes – Attack vector not disclosed (unknown). Exfiltrated data includes personal identifiers (email, name, DOB), usernames, salted MD5 password hashes, and Steam activation keys. Source: Have I Been Pwned – DLH breach