VNG 2015 Data Breach
Company · Technology and internet services · Digital platform ecosystem · Vietnam
VNG Corporation Zing.vn Vietnamese Tech Platform Breach (2015): Over 163 Million User Accounts With Passwords & Personal Data Exposed
Vietnamese technology company with gaming, payments, cloud, and internet services.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
34/100
Lower riskHigher risk
Moderate: notable exposure with meaningful misuse potential.
Data Sensitivity i
StandardExposed data is largely lower-sensitivity. Standard identity-protection precautions are advised.
163MRecords
2015Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
AddressPhysical address
Breach Summary
In May 2015, VNG Corporation’s Zing.vn platform suffered a data breach that exposed over 163 million user accounts (about 25 million unique email addresses). The compromised data included usernames, unsalted MD5 password hashes, emails, phone numbers, names, dates of birth, genders, IP addresses, home addresses, marital statuses, and occupations. The breach became public in April 2018 when the data appeared on hacking forums and was later added to Have I Been Pwned (via dehashed.com); it resurfaced in 2024 within larger leaked-data compilations. No specific threat actor or intrusion vector has been reliably established. (Note: a "passport" field cited in one catalog was not corroborated by HIBP or Vietnamese authorities and is treated as unconfirmed.)
Full threat analysis, exploitation vectors, and principal guidance below.
10 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
163M records analyzed
About VNG
VNG Corporation is a major Vietnamese technology company (founded 2004) operating a broad internet ecosystem including online gaming, the Zalo messaging platform, ZaloPay digital payments, Zing entertainment/media, and cloud services. Through Zing.vn and related products it maintained tens of millions of user accounts with identity, contact, and credential data.
Why They Hold Your Data
Digital platform ecosystems collect user identity, contact details, gaming records, payment data, messaging activity, and service-linked behavioral data across multiple internet services.
Recent Developments
The 2015 Zing.vn breach became public in April 2018 when the data was found trading on hacking forums, prompting a VNG apology and Vietnamese Ministry of Public Security involvement. The dataset resurfaced in 2024 within larger leaked-record compilations (e.g., on BreachForums). VNG has continued to grow into one of Vietnam’s largest tech firms and a regional gaming and fintech player.
Data Points Exposed
11 verified field types
Date of Birth High
Email Address
Full Name
Gender
IP Address
Job Information
Password High
Phone Number
Physical address High
Relationship Status
Username
Breach Impact
The breach exposed credentials (unsalted MD5 password hashes) alongside emails, names, dates of birth, addresses, and other profile data for over 163 million accounts, one of the largest breaches in Vietnamese history. Weak password hashing makes account takeover and credential stuffing highly feasible, and the combination of contact and profile data supports large-scale phishing and identity linkage across VNG’s services and beyond.
Exploitation & Downstream Threats
• Credential stuffing and account takeover against reused passwords (unsalted MD5, easily cracked) | • Identity verification bypass using name + date of birth | • Large-scale targeted phishing using exposed emails and profiles | • SIM swap attacks where phone numbers are present | • Doxxing and profiling from address, occupation, and marital-status data
Principal Risk Advisory
What this means for a principal
A consumer-service breach: contact and account data supports phishing, account takeover and profile enrichment. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
What You Should Do
- Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
- Reset any reused passwords and enable MFA on email first, then financial accounts.
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation