Earth 2 Game Exposes 421 k Email Addresses via Gravatar Integration
What Happened – In October 2024, the virtual‑world platform Earth 2 disclosed that 420,961 unique email addresses and associated usernames were harvested from embedded Gravatar avatar links. The root cause was the way Gravatar serves avatar URLs as MD5 hashes of email addresses, which Earth 2’s service exposed to the public. The company has since disabled the feature.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of third‑party service dependencies that can unintentionally leak personal data.
- Highlights the need for continuous monitoring and evidence collection on vendor integrations to satisfy audit‑ready control‑assurance programs.
- Shows how a single mis‑configuration can create a defensible gap in data‑protection controls across multiple compliance frameworks.
Who Is Affected – Online gaming platforms, SaaS applications that embed external avatar services, and any organization that relies on third‑party APIs for user‑facing content.
Recommended Actions
- Conduct an inventory of all third‑party integrations and assess their data‑exposure impact.
- Implement data‑minimization controls (e.g., avoid transmitting raw email hashes to external services).
- Deploy continuous monitoring to detect unintended data leakage from vendor APIs and retain evidence for audit readiness.
Source: Have I Been Pwned – Earth 2 breach
Technical Notes – Attack vector: third‑party dependency (Gravatar) exposing MD5‑hashed email addresses. Data types exposed: email addresses, usernames. No passwords or financial data were compromised. Source: same as above