Facepunch data breach: 342K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2018-10-17
In June 2016, the game development studio Facepunch suffered a data breach that exposed 343k users. The breached data included usernames, email and IP addresses, dates of birth and salted MD5 password hashes. Facepunch advised they were aware of the incident and had notified people at the time. The data was provided to HIBP by whitehat security researcher and data analyst Adam Davies. Exposed data: dates of birth, email addresses, ip addresses, passwords, usernames. The breach dates from Jun 3, 2016; Have I Been Pwned loaded it on Oct 17, 2018.
What to do
- If you had a Facepunch account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
