Earth 2 earth2.io Earth 2 data breach: what happened and what to do
In October 2024, 421k email addresses from the Earth 2 game were derived from embedded Gravatar images. HIBP lists 420,961 accounts. Exposed: email addresses and usernames. No passwords or financial data.
View all 13,177 breaches- Breach date
- 16 Oct 2024
- Affected
- 420,961
- Data exposed
- Email addresses, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Earth 2 is a virtual earth game. In October 2024, about 421,000 unique email addresses were derived from Gravatar images embedded in the platform. Have I Been Pwned (HIBP) lists 420,961 affected accounts, with the breach dated 16 October 2024 and added on 7 November 2024.
The root cause was how Gravatar presents avatar links: as MD5 hashes of the email address. Anyone able to see those links could work back to the email addresses. Earth 2 told HIBP it has disabled this feature on its platform.
Sources checked: haveibeenpwned.com, consumer.ftc.gov, cisa.gov
Last verified against the official page:
What was exposed
HIBP lists email addresses and usernames. HIBP states the incident did not expose further personal information, passwords or financial data.
What that lets criminals do
An email address next to a username lets a scammer target you with phishing that mentions the game, and link your game identity to your email.
What to do
Since passwords weren't exposed, the risk is mostly spam and phishing. A password change isn't required for this breach, but a separate email address for games keeps this kind of leak away from your main inbox. If you have an Earth 2 account, treat any message about it that arrives by email with caution, and sign in by typing the address yourself.
What to do if you were in it
- 1
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls with suspicion, especially ones that mention this breach or ask you to act fast. Don't click links in them; go to the company's site yourself. The FTC explains how to spot phishing. Be wary of messages about your Earth 2 account or in-game property.
- 2
Consider a separate email for games
Using a different email address for gaming accounts keeps this kind of leak away from your main inbox.
- 3
Turn on two-factor login
Add two-factor authentication to your important accounts, starting with email. CISA recommends turning it on wherever it's offered.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email or phone number. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak. It can't remove data that has already leaked.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Earth 2 breach?
Search your email on Have I Been Pwned or run a free Serus scan. HIBP lists 420,961 accounts.
What was exposed?
Email addresses and usernames. HIBP says no passwords or financial data were exposed.
Should I change my password?
It isn't required for this breach. Change it anyway if you reuse passwords.
How did the emails leak?
They were derived from Gravatar avatar links that present email addresses as MD5 hashes, according to HIBP.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
