Tunngle tunngle.net Tunngle data breach: what happened and what to do
In 2016, the now defunct gaming network Tunngle was breached. Have I Been Pwned lists 8,192,928 accounts: email addresses, IP addresses, usernames and salted MD5 password hashes. It added the data in October 2023.
View all 13,177 breaches- Breach date
- Jul 2016
- Affected
- 8,192,928
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Tunngle was a LAN gaming network that let players connect over the internet as if they shared a local network. It was breached in 2016. Have I Been Pwned (HIBP) lists 8,192,928 accounts and added the data on 21 October 2023. HIBP describes the service as now defunct.
Sources checked: haveibeenpwned.com, web.archive.org, consumer.ftc.gov
Last verified against the official page:
What was exposed
According to HIBP: email addresses, usernames, IP addresses and passwords stored as salted MD5 hashes. A salted hash isn't the plain password, but a leaked hash can still be attacked offline, and an old, easy-to-guess password is the most exposed.
What it means for you
With your email and username, a scammer can open a phishing message with your gaming handle. Your IP address gives a rough idea of where you connected from at the time. The bigger risk is password reuse: if the same password sits on another account, an attacker can try it there.
The company's response
The service no longer runs, so there's no company notice or support page to point to. HIBP's entry is the main public record of the breach, and the original Tunngle site survives only as an archived copy.
What to do if you were in it
- 1
Change the password and anywhere you reused it
If your Tunngle password is in use on any other account, change it there now. Give each account a different password; a password manager makes that easy.
- 2
Turn on two-factor login
Set up an authenticator app or passkey on your important accounts, email first. It blocks most takeovers even when a password has leaked. The FTC lists this among its post-breach steps.
- 3
Expect scam messages
Your email and gaming username are out there, so phishing emails and texts can sound convincing. Don't click links in messages you didn't expect. Go to the company's site yourself.
- 4
Check where else your details have leaked
A free Serus scan shows which other breaches include your email or phone.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the Tunngle breach?
Check your email address on Have I Been Pwned. If it's listed under Tunngle, you were among the 8,192,928 accounts HIBP loaded.
What was exposed in the Tunngle breach?
Email addresses, usernames, IP addresses and salted MD5 password hashes, according to HIBP.
Should I change my password?
Yes, if you ever reused your Tunngle password elsewhere. Change it on those accounts and use a unique one for each.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
What changed
- Page text rewritten to be clearer; facts and sources unchanged.
