Snail Gaming Site Exposes 1.41 M User Accounts with Unsalted MD5 Passwords
What Happened — In March 2015 the online gaming platform Snail suffered a data breach that compromised 1,410,899 subscriber records. Exposed data included usernames, email addresses, IP addresses and passwords that were stored as unsalted MD5 hashes. The breach details were disclosed through Have I Been Pwned after being supplied by dehashed.com.
Why It Matters for Trust & Control Assurance
- Storing passwords with weak, unsalted hashes violates basic credential‑management controls that a continuous assurance program must monitor and evidence.
- The incident demonstrates the need for documented password‑policy enforcement, regular cryptographic‑algorithm reviews, and audit‑ready proof of secure credential storage.
- Continuous control monitoring can surface insecure hashing practices before they lead to large‑scale exposure, providing a defensible audit trail.
Who Is Affected — Gaming and online entertainment services; any organization that handles user credentials without strong hashing.
Recommended Actions
- Conduct an immediate credential‑storage audit and replace unsalted MD5 hashes with a modern, salted algorithm (e.g., bcrypt, Argon2).
- Enforce a strong password policy and implement multi‑factor authentication where feasible.
- Capture and retain evidence of hashing standards and periodic reviews to satisfy audit requirements.
Source: Have I Been Pwned – Snail breach
Technical Notes
- Attack vector appears to be exploitation of insecure credential storage; no specific CVE is associated.
- Data types exposed: email addresses, IP addresses, usernames, and password hashes (unsalted MD5).
Source: Have I Been Pwned – Snail breach