Funny Games Breach Exposes 764,357 User Accounts and Password Hashes
What Happened – In April 2018 the online entertainment platform Funny Games suffered a breach that exposed 764,357 user records, including usernames, email addresses, IP addresses, and salted MD5 password hashes. The breach was disclosed to the company in July 2018; Funny Games confirmed the incident and traced the cause to legacy code that was no longer in active use. The compromised records represent roughly half of the site’s user base.
Why It Matters for Trust & Control Assurance
- The incident highlights a gap in credential protection – weak hashing (MD5) and inadequate de‑provisioning of legacy components violate the control objective of “secure storage and management of authentication credentials.”
- Continuous control‑assurance programs require evidence that all code paths handling passwords are inventoried, reviewed, and protected, especially when they are retired or superseded.
- Demonstrating a defensible audit trail for credential‑handling policies is essential for meeting multiple frameworks (e.g., NIST CSF, ISO 27001) with a single control.
Who Is Affected – Online entertainment services, SaaS gaming platforms, and any organization that stores user credentials for web‑based applications.
Recommended Actions
- Immediately force a password reset for all affected accounts and migrate to a strong, adaptive hashing algorithm (e.g., Argon2, bcrypt).
- Conduct a comprehensive inventory of legacy code, retire or sandbox unused modules, and apply secure‑development lifecycle checks.
- Map the credential‑protection control to your audit‑readiness framework, collect evidence of hashing standards, and document remediation steps in your Trust Center.
Technical Notes – The breach stemmed from legacy application code that continued to process authentication requests using salted MD5 hashes, a cryptographic function considered weak by modern standards. No public CVE is associated with the incident; the exposure was limited to user‑generated data (email, IP, username, password hash). Source: Have I Been Pwned – Funny Games breach