Gamerzplanet Forum Breach Exposes 1.2M User Accounts and Weak Password Hashes
What Happened — In October 2015 the public gaming forum Gamerzplanet was compromised. Attackers exfiltrated 1,217,166 records containing email addresses, IP addresses, usernames, and password hashes. The vBulletin platform stored passwords with a weak salted‑hash implementation that could be cracked rapidly.
Why It Matters for Trust & Control Assurance
- Highlights the necessity of a documented credential‑storage control that mandates strong, memory‑hard hashing algorithms.
- Shows the value of continuous monitoring to detect insecure cryptographic configurations in third‑party or legacy platforms.
- Provides a concrete incident that a control‑assurance program can capture as evidence of due‑diligence and remediation.
Who Is Affected — Online gaming communities, public forums, SaaS providers that manage user credentials, and any organization relying on legacy forum software.
Recommended Actions
- Replace the weak hashing scheme with an industry‑standard algorithm (e.g., Argon2, bcrypt).
- Integrate password‑policy compliance into your continuous control‑monitoring workflow.
- Conduct a post‑incident audit mapping the “protect credential integrity” control objective and collect remediation evidence.
- Notify affected users in accordance with applicable breach‑notification regulations.
Source: Have I Been Pwned – Gamerzplanet breach
Technical Notes — The breach leveraged a vulnerable implementation of password hashing in vBulletin; no specific CVE was published. Exposed data types: email, IP, username, and password hashes (salted but weak). Source: same as above