Activision activision.com Activision data breach: what happened and what to do
In December 2022 attackers tricked an Activision HR employee into giving up access. Have I Been Pwned lists 16,006 accounts, with emails, names, phone numbers, job titles and office locations of employees exposed.
View all 13,115 breaches- Breach date
- 4 Dec 2022
- Affected
- 16,006
- Data exposed
- Email addresses, Geographic locations, Job titles, Names, Phone numbers
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
This breach hit Activision's employees, not its players. It dates to 4 December 2022 and was added to Have I Been Pwned (HIBP) on 3 October 2023.
What happened
HIBP says attackers socially engineered an Activision HR employee into disclosing information, which led to the breach of almost 20,000 employee records. BleepingComputer reported that the data was later leaked on a cybercrime forum. Activision said no sensitive employee information, game code or player data was accessed, according to TechRadar.
What was exposed
HIBP lists 16,006 unique email addresses, along with names, phone numbers, job titles and the geographic location of the employee's office.
That is contact data, not financial or identity data, but it is exactly what a phisher wants. Messages that use your real job title and office look like they come from a colleague or recruiter. Employees of a well-known games company are also a natural target for fake job offers and fake IT notices asking for a login.
What to do
If you work or worked at Activision, expect targeted emails and texts and verify unusual requests through a channel you already trust. Players were not part of this dataset.
What to do if you were in it
- 1
Be wary of messages that use your job details
Treat emails and texts that mention your role or office as suspect until you've verified the sender another way. Don't enter a login after clicking a link in a message.
- 2
Turn on two-factor login with an app
This attack worked by talking someone out of access. Use an authenticator app or passkey rather than SMS codes where you can, and never read a code out to anyone who contacts you.
- 3
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls as suspect, especially ones that name the company or offer help with the breach. Don't click links in them; go to the company's site yourself.
- 4
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the Activision breach?
It involved employee records, not player accounts. Look up your email on Have I Been Pwned, or run a free Serus scan.
What was exposed?
Email addresses, names, phone numbers, job titles and office locations.
Were passwords or player data taken?
HIBP lists no passwords, and Activision said no sensitive employee information, game code or player data was accessed.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
