Evony evony.com Evony data breach: what happened and what to do
In June 2016, the online game Evony was hacked and more than 29 million unique accounts were exposed: usernames, email addresses, IP addresses and unsalted MD5 password hashes. Have I Been Pwned added it in March 2017.
View all 13,177 breaches- Breach date
- Jun 2016
- Affected
- 29,396,116
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Evony is an online multiplayer strategy game. It was hacked in June 2016, and Have I Been Pwned (HIBP) later recorded more than 29 million unique accounts from the attack. The data surfaced publicly and HIBP added it in March 2017, which is when many players first got a way to check.
What happened
HIBP's entry points to press coverage of the incident. The facts on this page are the ones HIBP records.
Sources checked: haveibeenpwned.com
Last verified against the official page:
What was exposed
HIBP lists four kinds of data: usernames, email addresses, IP addresses and passwords. The passwords weren't in plain text. They were MD5 hashes with no salt. MD5 is an old, fast hashing method, and without a salt the same password always gives the same hash. That makes unsalted MD5 quick to crack at scale, especially for common passwords.
What it means for you
Had an Evony account in 2016? Assume the password you used then is known. The real risk is to your other accounts, because people try leaked email and password pairs on other sites (credential stuffing). Your email and IP address also tie your game username to you, which can feed targeted phishing.
The breach is more than nine years old, so the practical question is whether you still use that password, or a close variation of it, anywhere that matters.
What to do if you were in it
- 1
Change the password here and anywhere you reused it
Set a new password on the affected account, then change it on every other account where you used the same or a similar one. A password manager makes unique passwords easy. Turn on two-factor login where the site offers it.
- 2
Treat unexpected emails that mention the breach with suspicion
Criminals use breach details to make scam emails look real. Don't click links in a message you didn't expect. Go to the company's site by typing the address yourself.
- 3
Check whether your email or phone is in this and other breaches
Serus runs a free scan that checks breach databases for your email address and phone number, and Serus monitors the dark web and breach databases and alerts you when your details turn up again. Breach data can't be taken back once it has leaked, so the scan tells you what to change, not what to delete.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Evony data breach?
If you had an Evony account in June 2016 and used an email address that is in Have I Been Pwned's Evony entry, yes. Search your email on Have I Been Pwned or run a Serus free scan.
What was exposed in the Evony breach?
Usernames, email addresses, IP addresses and MD5 password hashes without salt, according to Have I Been Pwned.
Should I change my password after the Evony breach?
Yes, if you still use a password from that account anywhere. Unsalted MD5 hashes are fast to crack, so treat the old password as known.
Sources
- Have I Been Pwned: Evony
- Have I Been Pwned: Evony Data Breach · haveibeenpwned.com
Something wrong or out of date? Tell us and we'll re-check it.
What changed
- Page text rewritten in plainer language; no facts changed.
