Mortal Online mortalonline.com Mortal Online data breach: what happened and what to do
In June 2018 the MMORPG Mortal Online was breached. About 607,000 accounts leaked with email addresses, names, usernames, physical addresses and MD5 password hashes. If you had an account, change that password anywhere you reused it.
View all 13,115 breaches- Breach date
- 17 Jun 2018
- Affected
- 606,637
- Data exposed
- Email addresses, Names, Passwords, Physical addresses, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
In June 2018, the fantasy game Mortal Online, made by Star Vault, suffered a data breach. Have I Been Pwned (HIBP) lists it as a verified breach. It was added to HIBP on August 31, 2018.
What happened
A file with around 570,000 email addresses and cracked passwords was first passed around online. A larger file followed, with about 607,000 email addresses and the original unsalted MD5 password hashes, plus names, usernames and physical addresses. HIBP updated its entry to match the bigger file. The data came to HIBP from security researcher Adam Davies. The studio has a notice on its own site about the incident.
What was exposed
HIBP lists 606,637 accounts. The data: email addresses, names, passwords, physical addresses and usernames.
The passwords were hashed with MD5 and no salt. That is a weak setup: a hash is a scrambled version of a password, and unsalted MD5 hashes of common passwords can be reversed quickly. The first file, in fact, already carried cracked passwords. Treat any password you used on a Mortal Online account as known to criminals.
What that lets criminals do
The most direct risk is credential stuffing: trying the same email and password pair on other sites, on other games and on your email. People reuse passwords a lot, so a single old game login can open something that matters.
The names and physical addresses make phishing and scam mail more believable, because a message that gets your name and street right looks legitimate. It also gives scammers a head start if they want to look you up on people-search sites.
What to do now
Start with email: change any password that matched your Mortal Online login. Then turn on two-factor login. Still not playing? Ask the studio to delete the account.
What to do if you were in it
- 1
Change your Mortal Online password, and every reuse of it
If you used the same or a similar password anywhere else, change it there too. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your email and other important accounts. It stops most takeovers even when an old password is out there.
- 3
Expect phishing that fits the data
Email addresses end up on spam and scam lists. Don't click links in messages that mention an account or a breach; go to the site yourself.
- 4
See which other breaches include you
Run a free Serus scan to see which other breaches include your email or phone.
Frequently asked
Was I affected by the Mortal Online breach?
If you had an account around 2018, check your email on Have I Been Pwned or run a free Serus scan. HIBP lists about 606,637 accounts in this breach.
What was exposed in the Mortal Online breach?
Email addresses, names, passwords stored as unsalted MD5 hashes, physical addresses and usernames.
Should I change my password?
Yes. Change it on every site where you used your Mortal Online password. MD5 hashes like these can be cracked quickly.
Can leaked data be removed from the internet?
No. Breach files circulate beyond anyone's control. You protect yourself with new passwords and two-factor login. Serus monitors breach databases and alerts you when your data shows up.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
