IDC Games idcgames.com IDC Games data breach: what happened and what to do
In March 2021 about 4 million records from IDC Games were shared on a public hacking forum: usernames, email addresses and passwords stored as salted MD5 hashes. Have I Been Pwned counts 3,966,871 accounts.
View all 13,115 breaches- Breach date
- 15 Mar 2021
- Affected
- 3,966,871
- Data exposed
- Email addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
IDC Games is an online games company. Have I Been Pwned (HIBP) lists a breach dated March 15, 2021 with 3,966,871 affected accounts, added in November 2021.
What happened
In March 2021, 4 million records sourced from IDC Games were shared on a public hacking forum.
What was exposed
The data includes usernames, email addresses and passwords. HIBP says the passwords were stored as salted MD5 hashes. A hash is a scrambled version of a password, and a salt is a random value added before scrambling so identical passwords don't look identical. MD5 is an old, fast method, which makes it easy for attackers to guess weak and common passwords at scale. If your IDC Games password was short or a real word, assume it can be recovered.
With a username and email, a criminal can try your password on other sites, a tactic called credential stuffing. Gaming accounts are also a target in their own right, for stolen in-game items and for access to linked payment methods.
The company's response
HIBP marks the breach as verified.
What to do if you were in it
- 1
Change your password, and anywhere you reused it
Set a new password for IDC Games. If you used the same one anywhere else, change it there too, starting with email and banking. Use a password manager so every account gets its own.
- 2
Turn on two-factor authentication
Add an authenticator app or a passkey to your email, banking and shopping accounts. A leaked password alone then isn't enough to get in.
- 3
Check your gaming and payment accounts
Look for logins or purchases you didn't make on gaming accounts, and remove saved payment cards you don't use.
- 4
Expect phishing that mentions this breach
Criminals use leaked names and emails to write convincing messages. Don't click links in unexpected emails or texts, and go to the company's site by typing the address yourself.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. It looks across breach databases and the dark web for your email and phone number and tells you what to do about each hit.
Frequently asked
Was I affected by the IDC Games breach?
Search your email address on Have I Been Pwned, or run a free Serus scan to check breach databases and the dark web for your email and phone.
What was exposed?
Usernames, email addresses and passwords stored as salted MD5 hashes.
How many people were affected?
HIBP lists 3,966,871 accounts.
Should I change my password?
Yes, on IDC Games and anywhere you reused it. MD5 hashes of weak passwords can be cracked quickly.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
