Evony evony.com Evony data breach: what happened and what to do
In June 2016 the online game Evony was hacked and more than 29 million unique accounts were exposed: usernames, email addresses, IP addresses and unsalted MD5 password hashes. It was added to Have I Been Pwned in March 2017.
View all 13,115 breaches- Breach date
- Jun 2016
- Affected
- 29,396,116
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Evony is an online multiplayer strategy game. In June 2016 it was hacked, and Have I Been Pwned (HIBP) later recorded more than 29 million unique accounts from the attack. The data surfaced publicly and HIBP added it to its database in March 2017, which is when many players first had a way to check whether they were in it.
What was exposed
HIBP lists four kinds of data: usernames, email addresses, IP addresses and passwords. The passwords weren't stored in plain text. They were MD5 hashes with no salt. MD5 is a fast, old hashing method, and without a salt the same password always produces the same hash. That makes unsalted MD5 hashes quick to crack at scale, especially for common passwords.
What it means for you
If you had an Evony account in 2016, assume the password you used then is known. The risk is mostly to your other accounts: people try leaked email and password pairs on other sites, a technique called credential stuffing. Your email address and IP address also tie your game username to you, which can feed targeted phishing.
The breach is more than nine years old, so the practical question is whether you still use that password, or a close variation of it, anywhere that matters.
The company's response
HIBP's entry points to press coverage of the incident. The facts on this page are the ones HIBP records.
What to do if you were in it
- 1
Change the password here and anywhere you reused it
Set a new password on the affected account, then change it on every other account where you used the same or a similar one. A password manager makes unique passwords easy. Turn on two-factor login where the site offers it.
- 2
Treat unexpected emails that mention the breach with suspicion
Criminals use breach details to make scam emails look real. Don't click links in a message you didn't expect. Go to the company's site by typing the address yourself.
- 3
Check whether your email or phone is in this and other breaches
Serus runs a free scan that checks breach databases for your email address and phone number, and Serus monitors the dark web and breach databases and alerts you when your details turn up again. Breach data can't be taken back once it has leaked, so the scan tells you what to change, not what to delete.
Frequently asked
Was I affected by the Evony data breach?
If you had an Evony account in June 2016 and used an email address that is in Have I Been Pwned's Evony entry, yes. Search your email on Have I Been Pwned or run a Serus free scan.
What was exposed in the Evony breach?
Usernames, email addresses, IP addresses and MD5 password hashes without salt, according to Have I Been Pwned.
Should I change my password after the Evony breach?
Yes, if you still use a password from that account anywhere. Unsalted MD5 hashes are fast to crack, so treat the old password as known.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
