SwordFantasy MMO Breach Exposes 2.7 Million User Accounts
What Happened
In January 2019 the now‑defunct online game SwordFantasy suffered a breach that compromised approximately 2.69 million user records. The exposed data included email addresses, usernames, IP addresses and salted MD5 password hashes.
Why It Matters for Compliance & Audit Readiness
- Highlights the necessity of continuous credential‑storage controls (strong, memory‑hard hashing, secret rotation, and documented key‑management) that can be evidenced during audits.
- Underscores the value of a documented third‑party risk program and incident‑response playbooks aligned with NIST CSF Identify/Respond functions.
- Demonstrates how delayed breach notification can affect GDPR, CCPA, and other privacy‑law obligations, requiring defensible evidence of remediation timelines.
Who Is Affected
- Online gaming platforms and virtual‑world providers.
- SaaS applications that store user credentials with legacy hashing algorithms.
- End‑users (players) whose personal identifiers were disclosed.
Recommended Actions
- Inventory all legacy authentication stores and verify use of modern, memory‑hard hashing (e.g., Argon2, bcrypt).
- Validate that breach‑notification procedures meet applicable privacy regulations and are documented in your control‑assurance framework.
- Request a post‑incident report from the vendor (if still under contract) and update your risk register accordingly.
Technical Notes
- Attack vector: Likely unauthorized database access; exact method not disclosed.
- CVEs: None reported.
- Data types exposed: Email addresses, usernames, IP addresses, salted MD5 password hashes.
Source: https://haveibeenpwned.com/api/v3/breach/SwordFantasy