Stalker Online data breach: what happened and what to do

What happened

In May 2020, researchers at Cybernews found two databases from the MMO game Stalker Online for sale online. According to Bitdefender's write-up, one held over 1.2 million user records and the other more than 136,000 records from the game's forums. The researchers contacted the game's developers and parent company on May 8 and got no reply or comment. The listing was removed on May 29, 2020.

Have I Been Pwned later added the data and counts 1,385,472 accounts. Its entry says the data included email addresses, IP addresses, usernames and hashed passwords.

What was exposed

The records contain email addresses, usernames, IP addresses and passwords stored as hashes. A hash is a scrambled version of a password, which is meant to stop anyone reading the original. According to Bitdefender, the passwords were MD5 hashes with a salt. MD5 is an old, fast algorithm, and researchers warned that hashes like these can be converted back into plain text, especially for common passwords. A salt makes that harder but doesn't prevent it.

What it means for you

The main risk is credential stuffing. Criminals take leaked email and password pairs and try them on other sites such as email providers, shops and streaming services, because many people reuse passwords. If you used your Stalker Online password anywhere else, that other account is the one to worry about, not the game.

Email addresses in the leak also mean spam and phishing, including messages that pretend to come from a game store or a support team. IP addresses reveal roughly where you were connecting from in 2020 but are unlikely to cause real harm years later.

The breach is old, so the most useful steps are cheap: make sure no account uses the old password, and turn on two-factor login on the accounts that matter, starting with your email.

Why old breaches still matter

A 2020 leak can feel too old to care about, but passwords outlive breaches. Many people keep the same password for years, or change one character at the end. Cracked hashes from an old game database get added to lists that attackers try against new targets, so an account you made in 2018 can still affect an account you use today. If you've since moved to a password manager and unique passwords, you're mostly fine. If you haven't, this is a good moment to do it, starting with your email account, because email is how password resets reach you.

The company's response

The researchers who found the data said they got no response from the developers or parent company when they reported it. The sources reviewed don't include a public statement from the company.

What Serus does here

Breach data can't be pulled back once it circulates. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak, so you can change what's affected.