CD Projekt RED cdprojektred.com CD Projekt RED data breach: what happened and what to do
In March 2016, a hack of the CD Projekt RED forum exposed almost 1.9 million accounts: usernames, email addresses and salted SHA1 password hashes. If you used that forum password anywhere else, change it there too.
View all 13,115 breaches- Breach date
- Mar 2016
- Affected
- 1,871,373
- Data exposed
- Email addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In March 2016, Polish game developer CD Projekt RED, the studio behind The Witcher series, suffered a data breach. The hack of its forum exposed almost 1.9 million accounts. Have I Been Pwned added the data to its index on 31 January 2017. The company posted a notice about potential unauthorized access to the forum's data on its forums.
What was exposed
Usernames, email addresses and salted SHA1 password hashes. A salted hash is a scrambled password with a random extra value added, which makes mass cracking slower. SHA1 is still a fast scheme, so short or common passwords can be recovered.
What it lets criminals do
A username and email address from a gaming forum are enough for targeted phishing: a message that claims to come from the studio or a game store and asks you to log in. The bigger risk is password reuse. If your forum password was weak and matches one you use on email, shopping or banking, attackers can try it there.
The company's response
CD Projekt RED published a forum announcement about the potential unauthorized access to the forum data, linked from Have I Been Pwned's entry.
What to do if you were in it
- 1
Change your password here and anywhere you reused it
Set a new password on the CD Projekt RED forum if you still have an account. Then change it on any other account that used the same or a similar password. A password manager makes unique ones easy.
- 2
Turn on two-factor login
Use an authenticator app or a hardware key on your email, banking and shopping accounts first, since those are what an attacker targets.
- 3
Be wary of messages that mention games or the studio
Phishing built on gaming accounts often copies store or launcher branding. Open the site yourself rather than following a link.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email or phone, and get alerts if new ones appear.
Frequently asked
Was I affected by the CD Projekt RED breach?
Search your email address on Have I Been Pwned, or run a free Serus scan, which checks breach databases for your email.
What was exposed?
Usernames, email addresses and salted SHA1 password hashes from the forum, almost 1.9 million accounts.
Should I change my password?
Yes, if you used the same password on any other account. Use a unique password on each site and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
