Facepunch Game Platform Breach Exposes 342,913 User Accounts
What Happened — In June 2016 the game‑development studio Facepunch suffered a data breach that exposed 342,913 user records. The leaked data included usernames, email addresses, IP addresses, dates of birth and salted MD5 password hashes. The breach was disclosed through Have I Been Pwned after a white‑hat researcher reported the incident.
Why It Matters for Trust & Control Assurance
- Weak password‑hashing (MD5) highlights the need for strong credential‑storage controls that can be continuously monitored and evidenced for audit readiness.
- Early detection of credential exposure through third‑party breach‑monitoring services is a core element of a defensible control‑assurance program.
- Documented identity‑access policies and security‑awareness training help demonstrate due‑diligence when regulators or partners request proof of protection.
Who Is Affected — Gaming and online entertainment platforms that store user credentials; any SaaS service handling personal data.
Recommended Actions
- Replace MD5‑based hashing with modern algorithms such as bcrypt, scrypt or Argon2 and re‑hash existing passwords.
- Enroll in a breach‑notification service (e.g., Have I Been Pwned) to receive real‑time alerts on credential exposure.
- Review and harden identity‑access policies, enforce multi‑factor authentication, and conduct regular security‑awareness training.
- Capture evidence of these controls in a continuous monitoring system to support audit readiness.
Technical Notes — The breach involved salted MD5 password hashes, usernames, email addresses, IP addresses and dates of birth. No specific vulnerability was disclosed; the exposure appears to stem from inadequate credential protection practices. Source: [Have I Been Pwned – Facepunch breach]