Mortal Online MMO Breach Exposes 606,637 User Accounts, Including Password Hashes and Physical Addresses
What Happened – In June 2018 the online game Mortal Online suffered a data breach. A file with ~570 k email addresses and cracked passwords was first leaked, followed by a larger dump of 607 k records that included unsalted MD5 password hashes, names, usernames and physical addresses.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of weak credential storage; continuous control‑assurance programs require evidence that password hashing meets industry‑accepted standards (e.g., salted, computationally‑hard algorithms).
- Demonstrating robust identity‑and‑access controls—and documenting remediation steps—provides a defensible audit trail for regulators and partners.
- Ongoing monitoring of credential‑related alerts helps detect misuse of exposed hashes before they lead to account takeover.
Who Is Affected – Online gaming platforms, SaaS services handling consumer credentials, and any organization that stores user‑identifying data.
Recommended Actions
- Replace unsalted MD5 hashes with a modern, salted algorithm (e.g., Argon2id) and enforce password rotation for affected accounts.
- Deploy multi‑factor authentication (MFA) for all user logins.
- Conduct a credential‑storage audit and capture evidence of remediation for audit readiness.
Technical Notes – The breach exposed email addresses, full names, usernames, physical mailing addresses, and original MD5 password hashes (unsalted). No CVE is associated; the exposure resulted from inadequate hashing practices and likely insecure database access. Source: [Have I Been Pwned – Mortal Online breach]