R2Games Breach Exposes Over 22 Million Gaming Accounts and Password Hashes
What Happened — In late 2015 the R2Games gaming portal was compromised. Attackers accessed the site’s vBulletin forum database, extracting email addresses, IP addresses, usernames and password hashes. The hashes were generated with a weak salted‑hash implementation, allowing large‑scale cracking and resulting in a total of 22,281,337 compromised records reported to Have I Been Pwned in 2016.
Why It Matters for Trust & Control Assurance
- Weak credential storage is a classic control gap that a continuous control‑assurance program should detect, remediate, and evidence.
- Demonstrating robust password‑hashing practices and regular credential‑access monitoring provides defensible audit evidence for identity‑access controls.
- The incident underscores the need for ongoing verification that authentication mechanisms meet industry‑accepted standards, a core element of the Access Controls capability.
Who Is Affected – Online gaming platforms, entertainment‑media web services, and any SaaS that handles large volumes of user credentials.
Recommended Actions – Review and upgrade password‑hashing algorithms to a proven, computationally‑hard scheme (e.g., Argon2id); implement continuous monitoring of credential‑access logs; capture evidence of hashing policy compliance for audit readiness. Source: Have I Been Pwned – R2Games breach
Technical Notes – The breach leveraged a vulnerability in the vBulletin forum software’s password‑hash implementation, not a disclosed CVE. Exposed data included email addresses, IP addresses, usernames and salted password hashes that were cracked using offline attacks. Source: same as above