OnRPG onrpg.com OnRPG data breach: what happened and what to do
In July 2016 the now defunct games list site OnRPG was breached. Have I Been Pwned counts 1,047,640 accounts: email addresses, IP addresses, usernames and passwords stored as salted MD5 hashes. The data resurfaced in 2025.
View all 13,115 breaches- Breach date
- Jul 2016
- Affected
- 1,047,640
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
OnRPG was a free online games list website that no longer runs. In July 2016 it suffered a data breach. The data didn't become widely known until years later, when it was redistributed as part of a larger corpus. Have I Been Pwned (HIBP) dates the breach to July 2016, added it on 8 May 2025 and counts 1,047,640 accounts.
What happened
HIBP says the incident exposed just over 1 million email and IP addresses together with usernames and passwords. Those passwords were stored as salted MD5 hashes. The site is gone, so no company notice exists, and the original attacker isn't named in HIBP's entry.
The data came to HIBP as part of a bigger collection that was circulating in 2025. This is a typical pattern for older breaches: they get bundled into compilations and reshared, so a breach from 2016 can reach you in a new round of spam and credential attacks nine years later.
What was exposed
HIBP lists email addresses, IP addresses, passwords and usernames. Salted MD5 is a weak way to store passwords. Hashing scrambles the password, and the salt makes each hash unique, but MD5 is quick to compute, so attackers can test large numbers of guesses per second. Weak and common passwords from a dump like this are usually recovered.
IP addresses show roughly where you were connecting from in 2016, which is old and of limited use today.
What that lets criminals do
The main danger is credential stuffing. If a password you used on OnRPG in 2016 is one you still use, attackers can try the email and password pair on email, shopping and other accounts. That's far more likely to work than it should be, because people reuse passwords for years.
Usernames can also link your gaming identity to your other accounts. If you used the same handle on other sites, someone can connect them.
Spam and phishing are the milder effects. An email address from a 2016 gaming list is useful to a spammer mainly because it's confirmed active.
Most of the people in this dataset have moved on from the site, so the risk depends on one question: do you still use the same password anywhere?
The company's response
The site is defunct, and HIBP lists no notice from the owners. The sources below describe how the data resurfaced.
How to check
Search your email address on HIBP. If it appears under OnRPG, think about which password you used on gaming sites around 2016 and whether you've reused it since.
Where to start
Think back to the password you used on gaming sites in 2016. If you still use it, or a close variation, change it now on every account that matters and let a password manager create the new ones. If you don't, there's little else to do.
What to do if you were in it
- 1
Change the password and anywhere you reused it
If you had a OnRPG account, set a new password there. Then change any other account that used the same password, starting with email, banking and shopping. A password manager makes unique passwords painless.
- 2
Turn on two-factor authentication
Use an authenticator app or a passkey on your email, bank and main social accounts. A stolen password alone then isn't enough to get in.
- 3
Use a password manager for unique passwords
Let a password manager generate a long random password for every site. Then a dump from one old site can't open another account.
- 4
Check other accounts that shared your username
If you used the same handle elsewhere, review those accounts, remove ones you no longer use and tighten the privacy settings on the rest.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan with Serus. It checks breach databases for your email address and phone number and shows which breaches include you, so you know which passwords and accounts to deal with first.
Frequently asked
Was I affected by the OnRPG breach?
Search your email address on Have I Been Pwned. It lists 1,047,640 accounts for OnRPG.
What was exposed?
Email addresses, IP addresses, usernames and passwords stored as salted MD5 hashes.
Should I change my password?
Yes, if you still use the password you had on OnRPG anywhere. MD5 hashes are weak and simple passwords are often cracked.
Why is a 2016 breach showing up now?
HIBP says the data was later redistributed as part of a larger corpus and added in May 2025.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
