GameSprite Data Breach Exposes 6.1M Accounts, Including Weak MD5 Password Hashes
What Happened — In December 2019 the now‑defunct GameSprite gaming platform suffered a breach that leaked 6,164,643 user records. Exposed data included email addresses, usernames, IP addresses and salted MD5 password hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates a classic credential‑protection failure that a continuous control‑assurance program is built to detect, remediate, and evidence.
- Weak hashing (MD5) and the lack of MFA undermine the “identity protection” control area, making it difficult to provide a defensible audit trail.
- Ongoing monitoring of credential exposure and documented password‑policy enforcement are essential to satisfy multiple frameworks (e.g., NIST CSF) with a single control objective.
Who Is Affected — Online gaming services, SaaS platforms handling consumer credentials, and any organization that stores passwords using inadequate hashing.
Recommended Actions
- Migrate all stored passwords to a modern, memory‑hard hash (bcrypt, Argon2, scrypt).
- Force a password reset for all affected accounts and enable mandatory MFA.
- Deploy continuous credential‑exposure monitoring to surface future leaks quickly.
- Capture evidence of these controls (policy documents, reset logs, MFA enrollment) for audit readiness.
Source: Have I Been Pwned – GameSprite breach
Technical Notes
- The breach released salted MD5 hashes, which are considered cryptographically weak and vulnerable to rainbow‑table attacks.
- No public details on the initial attack vector; the breach appears to be a data‑exfiltration incident.
Source: HIBP breach details