Armor Games armorgames.com Armor Games data breach: what happened and what to do
In January 2019 the game portal Armor Games was breached. About 10.6 million email addresses leaked with usernames, IP addresses and salted SHA-1 password hashes. Birth dates of administrator accounts were also exposed.
View all 13,115 breaches- Breach date
- Jan 2019
- Affected
- 10,604,307
- Data exposed
- Bios, Dates of birth, Email addresses, Genders, Geographic locations, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
In January 2019, the game portal Armor Games suffered a data breach. Have I Been Pwned (HIBP) added it on July 20, 2019 and lists it as verified.
What happened
According to TechRaptor, Armor Games learned of the breach on January 29, 2019 from a security group, and its own investigation put the intrusion at January 1. The data was part of a larger collection taken from more than a dozen sites and later offered on the dark web. Armor Games has said it has no evidence that user data was misused.
What was exposed
HIBP counts 10,604,307 accounts. The data classes are bios, dates of birth, email addresses, genders, geographic locations, IP addresses, passwords and usernames. HIBP notes that the birth dates were those of administrator accounts, not ordinary players.
Passwords were stored as salted SHA-1 hashes. Salting makes hashes harder to crack in bulk, but SHA-1 is fast, so weak passwords can still be recovered.
What that lets criminals do
Email plus a cracked password is the combination used in credential stuffing, where criminals try your login on other sites. IP addresses hint at your rough location. Usernames let people link your gaming identity to profiles elsewhere.
What to do now
If you ever had an Armor Games account, change that password anywhere you used it. A long, unique password is far less likely to be cracked from a salted hash. Turn on two-factor login on your email. If you no longer play, delete the account.
What to do if you were in it
- 1
Change your Armor Games password, and every reuse of it
If you used the same or a similar password anywhere else, change it there too. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your email and other important accounts. It stops most takeovers even when an old password is out there.
- 3
Expect phishing that fits the data
Email addresses end up on spam and scam lists. Don't click links in messages that mention an account or a breach; go to the site yourself.
- 4
See which other breaches include you
Run a free Serus scan to see which other breaches include your email or phone.
Frequently asked
Was I affected by the Armor Games breach?
If you had an account in 2019, possibly. Check your email on Have I Been Pwned or run a free Serus scan. HIBP lists 10,604,307 accounts.
What was exposed in the Armor Games breach?
Bios, dates of birth, email addresses, genders, locations, IP addresses, usernames and salted SHA-1 password hashes.
Were passwords exposed?
Yes, as salted SHA-1 hashes. Weak passwords can still be cracked from those.
Should I change my password?
Yes, on Armor Games and anywhere you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
