Powerbot Bot Site Breach Exposes 503,501 User Accounts (Emails, IPs, Password Hashes)
What Happened — In September 2014 the RuneScape bot platform Powerbot suffered a data breach that released more than half a million user records. The leaked data included email addresses, IP addresses, usernames and salted MD5 password hashes. The breach was later listed in the Vigilante.pw breached‑database directory.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential storage and insufficient access controls – a core control area that continuous‑control‑assurance programs monitor and evidence.
- Highlights the need for defensible audit trails around password hashing practices and privileged‑account protection.
- Aligns with Verisq’s Access Controls capability, which helps organizations prove they enforce strong authentication, password policies, and regular credential hygiene.
Who Is Affected – Online gaming services, community‑driven SaaS platforms, and any organization that stores user credentials without strong hashing or multi‑factor authentication.
Recommended Actions
- Review and upgrade password storage to modern, adaptive hashing (e.g., Argon2, bcrypt).
- Implement MFA for privileged and user‑facing accounts.
- Capture and retain evidence of credential‑policy enforcement for audit readiness.
- Map the credential‑protection control to your framework of record and collect continuous monitoring evidence.
Source: Have I Been Pwned – Powerbot breach
Technical Notes
- Data exposed: email, IP, username, salted MD5 password hashes.
- No public CVE; breach appears to stem from inadequate password‑hashing and possible credential‑theft via the site’s backend.
Source: HIBP breach details