JoyGames joygames.me JoyGames data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In December 2019, the forum for the JoyGames website was breached. Have I Been Pwned lists 4,461,787 accounts, with email addresses, IP addresses, usernames and salted MD5 password hashes exposed. It was added to the site in December 2023.
View all 13,118 breaches- Breach date
- 14 Dec 2019
- Affected
- 4,461,787
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In December 2019, the forum for the JoyGames website suffered a data breach. Have I Been Pwned (HIBP) lists 4,461,787 accounts and added them on 7 December 2023. HIBP describes the exposure as over 4.4 million unique email addresses.
Sources checked: haveibeenpwned.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
Email addresses, usernames, IP addresses and passwords stored as salted MD5 hashes. HIBP lists no names, phone numbers or payment details, so the exposure is narrower than in many breaches. Even so, an email address tied to a forum username is personal data, and forum accounts are often set up with a password the person uses elsewhere.
What it means for you
With an email and a username, a scammer can write a message that names your forum handle, which makes phishing look more credible. IP addresses hint at where you were when you posted. As with any leaked password hash, the real risk is reuse: a cracked password can be tried on your other accounts.
The company's response
HIBP's entry links no company notice, so it is the public record of the breach.
What to do if you were in it
- 1
Change the password and anywhere you reused it
If you used your JoyGames forum password on any other account, change it there now, and use a different password for each account. A password manager makes that easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your important accounts, starting with email. It blocks most takeovers even when a password has leaked. The FTC lists this among its post-breach steps.
- 3
Expect scam messages
With your email address and forum username out there, scammers can send convincing phishing emails and texts. Don't click links in unexpected messages; go to the company's site yourself.
- 4
Check where else your details have leaked
To see which other breaches include your email or phone, run a free Serus scan.
Frequently asked
Was I affected by the JoyGames breach?
Search your email on Have I Been Pwned. If JoyGames appears, you were among the 4,461,787 accounts listed.
What was exposed in the JoyGames breach?
Email addresses, usernames, IP addresses and salted MD5 password hashes, per HIBP.
Should I change my password?
Yes, if you reused your forum password anywhere. Change it there and use a unique one for each account.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
