6.5 M User Accounts Compromised in Dueling Network Data Breach
What Happened – In March 2017 the online Flash game Dueling Network suffered a breach that exposed 6,486,626 user records, including usernames, email addresses, IP addresses and passwords stored as unsalted MD5 hashes.
Why It Matters for Trust & Control Assurance
- Storing passwords with weak, unsalted hashes violates basic credential‑protection controls that continuous‑monitoring programs are built to detect and remediate.
- The incident illustrates the need for documented evidence that credential‑storage policies are enforced and regularly audited.
- Demonstrating robust identity‑and‑access controls (e.g., strong hashing, MFA, credential rotation) provides a defensible audit trail for regulators and partners.
Who Is Affected – Online gaming platforms, web‑based services handling consumer credentials, and any organization that stores user authentication data.
Recommended Actions
- Force password resets for all affected accounts and require stronger passwords.
- Replace MD5 hashing with a modern, salted algorithm such as bcrypt, scrypt, or Argon2.
- Implement multi‑factor authentication and enforce credential‑storage policies as part of a continuous control‑assurance program.
- Collect and retain evidence of these controls (policy documents, configuration snapshots, audit logs) to support audit readiness.
Source: Have I Been Pwned – Dueling Network breach
Technical Notes
- Attack vector: insecure credential storage (MD5 hashes) likely exposed through a database compromise or misconfiguration.
- No public CVE; the weakness is a design flaw in password handling.
- Exposed data types: email, IP, username, password hash.
Source: HIBP breach details