Games Box Breach Exposes 1.44 M User Accounts and Passwords
What Happened — In September 2020 the now‑defunct gaming portal Games Box suffered a data breach that later appeared in a public data‑dump. The breach disclosed 1,439,354 records containing email addresses, usernames, genders, ages and passwords (stored as plain‑text or weak hashes).
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential protection – a core control that continuous‑monitoring programs must verify and evidence.
- Highlights the need for defensible audit trails around password‑storage policies and encryption standards.
- Shows how a single lapse can erode user trust and trigger downstream compliance scrutiny (e.g., NIST CSF 2.0 Protect function).
Who Is Affected – Online gaming services, web‑based platforms that collect user credentials, and any organization that stores passwords without strong hashing.
Recommended Actions
- Review and harden password‑storage practices (use salted, adaptive hashing such as Argon2).
- Enable continuous monitoring of credential‑related controls and generate evidence for audit readiness.
- Update incident‑response playbooks to include credential‑leak detection and user notification procedures.
Source: Have I Been Pwned – Games Box breach
Technical Notes
- Attack vector unknown; breach likely stemmed from poor access controls or insecure data handling.
- Exposed data types: email, username, gender, age, password (plain‑text or weak hash).
Source: HIBP breach details