Dueling Network duelingnetwork.com Dueling Network data breach: what happened and what to do
Dueling Network, a Yu-Gi-Oh fan game forum, was breached in March 2017. About 6.5 million accounts had usernames, email addresses, IP addresses and MD5 password hashes exposed.
View all 13,115 breaches- Breach date
- 29 Mar 2017
- Affected
- 6,486,626
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Dueling Network was a Flash game based on the Yu-Gi-Oh trading card game. The game was taken offline in 2016 after a cease-and-desist order, but its forum stayed up for another year. In March 2017 the forum's database was stolen. Have I Been Pwned (HIBP) counts 6,486,626 affected accounts.
What was exposed
The data has usernames, email addresses, IP addresses and passwords stored as MD5 hashes. MD5 is a weak, fast algorithm, and most passwords protected by it can be recovered quickly with ordinary hardware.
A caveat on the numbers
Motherboard (Vice) reported the site's administrator saying that many of the accounts were duplicates or had never logged in, so the real number of people is lower than the account count. Plan as if you are affected if your email address appears.
What it lets criminals do
Once an MD5 hash is cracked, the password can be tried on other sites. An old gaming forum password that you also use for email or shopping is the thing to worry about. The email address also puts you on lists for phishing that mentions Yu-Gi-Oh or card trading.
The response
Users were told to change their password on any other service that shared it with Dueling Network. The forum has been offline for years, so there is no account left to secure there.
What to do if you were in it
- 1
Change your Dueling Network password
Go to the account settings and pick a new password. If the site is gone or you no longer use it, you can skip this step. The forum is offline, so the important part is anywhere else you used that password.
- 2
Change it everywhere you reused it
Look through your password manager or browser for logins that share the old password and replace each one, starting with email, banking and shopping accounts. Use a different password for every site.
- 3
Turn on two-factor authentication
Use an authenticator app or a hardware key on your email and any account that holds money or personal details. A stolen password alone then isn't enough to get in.
- 4
Expect phishing that uses your email address
Treat unexpected messages about your account, a prize or a password reset with suspicion. Don't click links in them: type the site address yourself or use its app.
- 5
Check whether your email is in this and other breaches
Run a free Serus scan on the email addresses and phone numbers you use. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about the next leak without checking by hand.
Frequently asked
Was I affected by the Dueling Network breach?
If you had an account on the forum, possibly. Search your email address on HIBP to check.
What was exposed in the Dueling Network breach?
Usernames, email addresses, IP addresses and passwords stored as MD5 hashes.
Should I change my password after the Dueling Network breach?
Yes, on every site where you used the same password. The forum itself is offline.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
