Epic Games epicgames.com Epic Games data breach: what happened and what to do
In August 2016, the Epic Games forum was breached, allegedly through a vBulletin SQL injection flaw. Have I Been Pwned counts 251,661 accounts with usernames, email addresses and salted MD5 password hashes.
View all 13,115 breaches- Breach date
- 11 Aug 2016
- Affected
- 251,661
- Data exposed
- Email addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In August 2016, the Epic Games forum suffered a data breach, allegedly because of a SQL injection vulnerability in vBulletin, the forum software it ran. Have I Been Pwned (HIBP) dates the breach to August 11, 2016, added it in November 2016, and counts 251,661 accounts. Coverage at the time, such as ZDNet, described the forums being hacked for the second time.
This was the forum, not the Epic Games Store or Fortnite accounts. If you only played games from Epic and never posted on its forums, you are unlikely to be in it.
What was exposed
HIBP lists email addresses, passwords and usernames. The passwords were salted MD5 hashes. Salting makes bulk cracking harder, but MD5 is fast, so weak passwords can still be recovered. Assume a short or common password from that forum is known.
The breach is a decade old, so the practical risk is reuse. If the forum password matched one you used elsewhere, an attacker can try the email and password pair against other services. The email address alone also keeps you on phishing lists.
What this means now
Check the address you used for the forum. If it appears, change the password anywhere you shared it and add two-factor login to your Epic account and your email.
What to do if you were in it
- 1
Change the password, and anywhere you reused it
If you had a Epic Games forum account, change that password and the password on any other site that used the same one. Use a different password for each site.
- 2
Turn on two-factor authentication
Add two-factor login on your email and bank accounts first, then your other main accounts.
- 3
Expect phishing that mentions the breach
Treat emails and texts that greet you by name, or mention this breach, with suspicion. Don't click the links; go to the company's site directly.
- 4
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web and alerts you when your email, passwords or other personal data appear, and tells you what to do next. It can't remove data that has already leaked, so the alert is the point: it tells you which passwords to change. You can run a free scan.
Frequently asked
Was I affected by the Epic Games forum breach?
Search your email on Have I Been Pwned. 251,661 accounts are listed.
What was exposed?
Usernames, email addresses and salted MD5 password hashes.
Does this affect my Fortnite or Epic Store account?
HIBP describes the breach as the Epic Games forum. Change any password you reused from the forum anyway.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
