29 Million Evony Game Accounts Breached – Email, IP, and Password Hashes Exposed
What Happened – In June 2016 the online multiplayer game Evony suffered a breach that exposed 29,396,116 unique accounts. The leaked data includes usernames, email addresses, IP addresses, and unsalted MD5 password hashes.
Why It Matters for Trust & Control Assurance
- This incident illustrates the risk of weak credential storage and the need for continuous verification that password hashing meets modern standards.
- It underscores the importance of an identity‑and‑access‑control program that can detect anomalous credential use and provide auditable evidence of protective measures.
Who Is Affected – Gaming and digital entertainment platforms; any organization that stores user credentials without strong hashing or salting.
Recommended Actions
- Immediately enforce password resets for affected users and require multi‑factor authentication where possible.
- Review and upgrade password‑storage mechanisms to use salted, computationally‑hard hashes (e.g., bcrypt, Argon2).
- Implement continuous monitoring of credential‑related logs to detect suspicious authentication attempts and retain evidence for audit readiness. Source: https://haveibeenpwned.com/api/v3/breach/Evony
Technical Notes
- Attack vector not publicly disclosed; exposure resulted from compromised account database.
- Data types leaked: email addresses, IP addresses, usernames, and MD5 password hashes (no salt). Source: https://haveibeenpwned.com/api/v3/breach/Evony