gPotato data breach: 2.1M accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2016-09-24
In July 2007, the multiplayer game portal known as gPotato (link to archive of the site at that time) suffered a data breach and over 2 million user accounts were exposed. The site later merged into the Webzen portal where the original accounts still exist today. The exposed data included usernames, email and IP addresses, MD5 hashes and personal attributes such as gender, birth date, physical address and security questions and answers stored in plain text. Exposed data: dates of birth, email addresses, genders, ip addresses, names, passwords, physical addresses, security questions and answers, usernames, website activity. The breach dates from Jul 12, 2007; Have I Been Pwned loaded it on Sep 24, 2016.
What to do
- If you had a gPotato account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
