JoyGames joygames.me JoyGames data breach: what happened and what to do
The forum for the JoyGames website was breached in December 2019. Have I Been Pwned lists 4,461,787 accounts: email addresses, usernames, IP addresses and salted MD5 password hashes. It added the data in December 2023.
View all 13,177 breaches- Breach date
- 14 Dec 2019
- Affected
- 4,461,787
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
The JoyGames website runs a forum, and in December 2019 someone got into its data. Have I Been Pwned (HIBP) lists 4,461,787 accounts and added them on 7 December 2023, four years after the breach. HIBP puts the exposure at over 4.4 million unique email addresses.
Sources checked: haveibeenpwned.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
Four things: email addresses, usernames, IP addresses and passwords stored as salted MD5 hashes (scrambled versions of the passwords, not the passwords themselves). HIBP lists no names, phone numbers or payment details. That's narrower than many breaches, but an email tied to a forum handle is still personal data, and forum passwords are often copies of one the person uses elsewhere.
What it means for you
A scammer holding your email and forum username can write a message that uses your handle, and that makes a phishing email look like it came from someone who knows you. Your IP address hints at where you were when you posted. The bigger risk is password reuse. If a hash gets cracked, the password gets tried on your other accounts.
The company's response
HIBP's entry links no company notice, so the HIBP listing is the public record of this breach.
What to do if you were in it
- 1
Change the password and anywhere you reused it
Start with any account that shares your JoyGames forum password, and give each one its own. A password manager does the remembering for you.
- 2
Turn on two-factor login
Set up an authenticator app or passkey on your important accounts, email first. It stops most takeovers even when a password has leaked. The FTC lists it among its post-breach steps.
- 3
Expect scam messages
Your email and forum username are out there, so a phishing email or text can sound personal. Don't click links in messages you didn't expect. Open the company's site yourself.
- 4
Check where else your details have leaked
A free Serus scan shows which other breaches include your email or phone.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the JoyGames breach?
Search your email on Have I Been Pwned. If JoyGames shows up, you're one of the 4,461,787 accounts listed.
What was exposed in the JoyGames breach?
Email addresses, usernames, IP addresses and salted MD5 password hashes, per HIBP.
Should I change my password?
Yes, if you reused your forum password anywhere. Change it on those accounts and use a different one for each.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
What changed
- Page text rewritten to be clearer; facts and sources unchanged.
