Data of more than 33 million accounts of the Evony gaming company were stolen as result of a data breach occurred in June. Evony is the company that developed the popular game Evony: Age II, that is played by more of 18 Million gamers in over 167 countries. Hackers breached the website of Evony gaming firm accessing 33,407,472 records of registered user accounts.
Two months later, on August, the website was breached again, at that time hackers compromised the Evony forum exposing data of 938,000 registered accounts.
The data breach notification service LeakedSource obtained a copy of the huge archive and published a detailed analysis of the leaked data.
“Gaming company Evony was hacked for a total of 33,407,472 users from its main game database in June of 2016. Earlier this year in August we discovered their forums were also hacked for 938k users.” states a blog post published by the company.
“Each record contains a username, email address, password, and ip address among other internal data fields. Users can now get notified any time they appear in a breach. If your personal information appears in our copy of this database, or in any other leaked database that we possess, you may remove yourself for free.”
Each record includes username, email address, password, and IP address and other internal data. The password were stored in unsalted MD5 and SHA-1 (Secure Hash Algorithm 1), this means that for hackers it is quite easy to decrypt them.
“Passwords were stored using unsalted MD5 hashing which means at this point we have cracked most of them. Surprisingly they also stored the passwords in unsalted SHA1 next to the MD5 which makes no sense but anyway” continues the post.
123456 was the most used password on the gaming site, this is the demonstration that users are a low perception of cyber threats and lack of awareness on a proper security posture online.
A look to the top email domains reveal that @Yahoo.com was one of the most popular, followed by @hotmail.com.
(Security Affairs – Evony data breach, hacking)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.