Mortal Online data breach: 606K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2018-08-31
In June 2018, the massively multiplayer online role-playing game (MMORPG) Mortal Online suffered a data breach. A file containing 570k email addresses and cracked passwords was subsequently distributed online. A larger more complete file containing 607k email addresses with original unsalted MD5 password hashes along with names, usernames and physical addresses was later provided and the original breach in HIBP was updated accordingly. The data was provided to HIBP by whitehat security researcher and data analyst Adam Davies. Exposed data: email addresses, names, passwords, physical addresses, usernames. The breach dates from Jun 17, 2018; Have I Been Pwned loaded it on Aug 31, 2018.
What to do
- If you had a Mortal Online account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch