Dota2 Forum Breach Exposes 1.9 M User Credentials (Salted MD5 Password Hashes)
What Happened – In July 2016 the official Dota 2 developers’ forum (hosted on dev.dota2.com) was compromised. Attackers extracted nearly 2 million records containing email addresses, IP addresses, usernames and passwords stored as salted MD5 hashes.
Why It Matters for Trust & Control Assurance
- Credential leakage illustrates the risk of weak password‑storage algorithms; continuous control‑assurance programs require evidence that cryptographic controls meet current best‑practice standards.
- The incident underscores the need for ongoing monitoring of authentication mechanisms and rapid evidence collection to demonstrate due‑diligence during audits.
- Demonstrating robust access‑control policies (e.g., MFA, password‑policy enforcement) provides a defensible audit trail that mitigates similar supply‑chain exposures.
Who Is Affected – Online gaming platforms, community forums, and any SaaS services that manage large volumes of user credentials.
Recommended Actions
- Immediately force password resets for all affected accounts and enforce a stronger hashing algorithm (e.g., bcrypt, Argon2).
- Deploy multi‑factor authentication (MFA) for forum and related services.
- Conduct a control‑mapping exercise to verify that password‑storage and authentication controls align with your audit framework.
- Implement continuous monitoring of authentication logs and retain evidence for audit readiness.
Source: Have I Been Pwned – Dota2 breach
Technical Notes – The breach originated from a compromise of the vBulletin forum software, likely exploiting a known vulnerability that allowed attackers to read the underlying database. Passwords were stored as salted MD5 hashes, which are considered cryptographically weak by today’s standards.