R2Games r2games.com R2Games data breach: what happened and what to do
In late 2015, hackers took data from gaming site R2Games. Have I Been Pwned counts over 22 million accounts with emails, usernames, IP addresses and weakly hashed passwords.
View all 13,115 breaches- Breach date
- Nov 2015
- Affected
- 22,281,337
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In late 2015, the gaming website R2Games was hacked and more than 2.1 million personal records were disclosed. Have I Been Pwned (HIBP) added a further 11 million accounts in March 2016 and another 9 million in July 2016, bringing its total to 22,281,337.
The leak came from a vBulletin forum. HIBP lists email addresses, usernames, IP addresses and passwords. The passwords were stored as salted hashes, but HIBP says the implementation was weak enough that many could be cracked quickly. A cracked password stops being a hash and becomes a plain login.
For a gaming account this matters in a specific way. Gamers reuse logins across storefronts, chat apps and email, and criminals run leaked pairs against all of them. Accounts holding purchased items or in-game currency are resold. An IP address also hints at your rough location, and the email address alone is enough to make phishing about "your R2Games account" believable.
Security press later reported a second R2Games exposure in 2017, with the company denying that it had been hacked. This page covers the 2015 breach as HIBP records it.
If you played an R2Games title before 2016, change the password on anything that shared it. Nothing can recall the data now, so the steps below are about limiting what a leaked login can reach.
What to do if you were in it
- 1
Change reused passwords
Find every account that used your R2Games password and change it. Start with your email account, since that can reset everything else. Use a unique password per site.
- 2
Turn on two-factor authentication
Enable it on email, game stores and any account holding payment details. An app-based code is safer than SMS.
- 3
Treat game-themed messages with caution
Emails about bans, free currency or account verification are a common phishing line. Open the game from its official app or site instead of the link.
- 4
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web for your email, phone number and passwords, and alerts you when they show up. You can run a free scan at serus.ai. Serus can't remove data from a breach, but it tells you what to change.
Frequently asked
Was I affected by the R2Games breach?
If you had an R2Games or forum account before 2016, possibly. Search your email on Have I Been Pwned, or run a free Serus scan.
What was exposed?
Have I Been Pwned lists email addresses, IP addresses, passwords and usernames.
Should I change my password?
Yes, and change it anywhere you reused it. The stored hashes were weak, so many passwords were cracked.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
