Gamigo Breach Exposes 8.2 M Accounts with Weak MD5 Password Hashes
What Happened — In March 2012 the German online game publisher Gamigo was hacked. Over 8,243,604 user records—including email addresses and passwords stored as unsalted MD5 hashes—were publicly leaked and later indexed by HaveIBeenPwned.
Why It Matters for Trust & Control Assurance
- Weak, unsalted MD5 hashes enable rapid password cracking, violating best‑practice credential‑protection controls.
- Continuous control‑assurance programs require demonstrable evidence that password storage meets strong cryptographic standards.
- A defensible audit trail of credential‑management policies helps prove due diligence to regulators and partners.
Who Is Affected — Online gaming platforms, SaaS services handling consumer credentials, and any organization that stores user passwords.
Recommended Actions
- Replace MD5 hashes with salted, adaptive algorithms such as bcrypt or Argon2.
- Force password resets for all affected accounts and communicate the change to users.
- Conduct a credential‑storage review, capture evidence of hashing standards, and map findings to your audit framework. Source: [HaveIBeenPwned breach record]
Technical Notes — The breach involved email addresses and passwords stored as plain MD5 hashes without salt, a cryptographically weak practice that can be reversed with commodity hardware. No specific CVE applies; the issue is a systemic control gap in password handling. Source: [HIBP API]