League of Legends leagueoflegends.com League of Legends data breach: what happened and what to do
In June 2012, League of Legends suffered a data breach. In 2018 a subset of 339,487 records surfaced, with email addresses, usernames and passwords. HIBP added it in July 2018.
View all 13,115 breaches- Breach date
- 11 Jun 2012
- Affected
- 339,487
- Data exposed
- Email addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
League of Legends, the multiplayer online game, was breached in June 2012. Have I Been Pwned (HIBP) lists a 339,487 record subset that emerged in 2018.
What happened
In June 2012, Riot Games disclosed a breach affecting League of Legends accounts on its European servers. HIBP notes the service had more than 32 million registered accounts at the time. Riot's notice said the affected data came from certain European databases, and affected players were emailed.
In 2018, a subset of 339k records appeared, holding email addresses, usernames and plain-text passwords. HIBP says the passwords were likely cracked from the originals, which had been protected. It added the data on 28 July 2018, and this is the set it lists today.
What was exposed
The HIBP data includes email addresses and usernames, plus passwords. Riot said at the time that no payment or billing information was included.
Email addresses and usernames let criminals target you with phishing aimed at gamers, such as fake skin offers. Cracked passwords matter most if you reused them: attackers try the same email and password pairs on other sites.
The company's response
Riot fixed the vulnerability and emailed affected players. It advised them to change their passwords. Reporting from 2012 also says Riot warned that many passwords were simple enough to be cracked easily.
What to do if you were in it
- 1
Change the password here and anywhere you reused it
If you used this password on another site, change it there first. Use a unique password for every account, ideally from a password manager.
- 2
Turn on two-factor authentication
Add an authenticator app or security key to your email and bank accounts, so a stolen password alone isn't enough.
- 3
Expect gaming phishing
Be careful with messages offering free skins or currency, and never enter your login on a link from an email. Go to the official site directly.
- 4
Run a free breach check
Check whether your email or phone number shows up in this and other breaches with a free Serus scan.
Frequently asked
Was I affected by the League of Legends breach?
HIBP lets you search your email address. A free Serus scan also checks it against this and other breaches.
What was exposed in the League of Legends breach?
Email addresses and usernames, plus passwords, in the HIBP data. Riot said payment and billing information was not included.
Should I change my password?
Yes, if you used it anywhere else. Use a unique password per account and turn on two-factor authentication.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
