Evony Online Strategy Game Breach (2016): 28 Million Player Accounts Including Passwords Exposed

About Evony

Evony (evony.com) is a long-running online multiplayer strategy game (Evony: The King's Return and earlier browser versions) with a large global player base.

Why They Hold Your Data

Strategy-game platforms collect player accounts, emails, gameplay history, alliance relationships, purchase-linked records, and community interactions tied to live-service gaming.

Recent Developments

In June 2016, Evony's main game database was hacked, exposing ~33.4 million registered accounts (~28.8M unique emails); a separate August 2016 forum breach exposed ~938,000 additional accounts. LeakedSource obtained and analyzed the data; it is documented on Have I Been Pwned.

Data Points Exposed

Breach Impact

The exposure of usernames, emails, IP addresses, and weakly-hashed passwords (unsalted MD5/SHA-1, easily cracked) for tens of millions of players enables large-scale credential-stuffing and account-takeover where passwords were reused, plus targeted phishing.

Exploitation & Downstream Threats

• Credential stuffing and account takeover against reused passwords (weak unsalted MD5/SHA-1, easily cracked) | • Targeted phishing using exposed emails

What You Should Do

1. Reset any reused passwords and enable MFA on email first, then financial accounts.
2. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping: cross-reference the exposed identifiers against broker-available data to size and prioritize the principal's wider footprint.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).