17173 Data Breach (2011): What Was Exposed & What To Do

Data breaches involving online platforms that store user credentials have formed a persistent element of the threat landscape since the early days of widespread internet services. The 17173 incident, reported on 28 December 2011, affected 7.5 million users of a Chinese gaming site and contributed to a larger series of breaches in China that year that touched up to 100 million accounts in total.

Records from the event contain usernames, email addresses and salted MD5 password hashes. The dataset was later referenced in public breach repositories with support from dehashed.com and has been flagged as unverified because of the practical difficulties of independent confirmation for incidents originating in that region at the time.

Breaking down the breach

The incident was publicly noted on 28 December 2011. It involved 7.5 million user records from the 17173 gaming platform. The exposed fields listed in available descriptions are usernames, email addresses and salted MD5 password hashes. No further technical details on the method of access or the precise timing of the intrusion have been disclosed in the reporting.

The breach occurred amid a cluster of similar incidents affecting Chinese online services during late 2011. While the data appears consistent with legitimate account records, the overall collection has been labelled unverified due to verification constraints common to that period and jurisdiction.

How a breach like this happens

Incidents of this type typically begin with an attacker obtaining unauthorised access to an organisation’s user database. Common pathways include exploitation of unpatched server software, compromised administrative credentials or misconfigured database exposure. Once inside, the attacker can copy tables containing account identifiers and authentication material.

Password data stored as salted MD5 hashes indicates an attempt to slow down offline cracking, yet the algorithm remains computationally feasible to attack with modern hardware when the original passwords are weak or reused. After extraction, the data may circulate privately before appearing in public repositories or on forums.

Who is 17173?

17173 operated as a prominent Chinese gaming portal that provided news, community features and account-based services to players. Organisations in this sector routinely maintain user accounts to support logins, forums and in-game purchases, which means they hold email addresses, usernames and password credentials as core operational data.

A compromise at such a site is consequential because gaming accounts frequently overlap with other online services through shared email addresses and reused passwords, extending the reach of any leaked credentials beyond the original platform.

What was likely exposed

The breach record names three categories of data: email addresses, passwords and usernames. The passwords are described as salted MD5 hashes rather than plaintext. No additional fields such as payment information or personal identifiers beyond these elements are listed in the available facts.

Exact contents remain unconfirmed because the dataset carries an unverified designation. Organisations of this kind commonly store the data types already named, but readers should treat any further assumptions as speculative.

The real-world impact

Individuals whose records appear in the dataset face the possibility that their email addresses and password hashes could be used in attempts to access other accounts where the same credentials were reused. The presence of salted hashes raises the effort required for attackers but does not eliminate the risk for weaker passwords.

For the organisation, the incident added to the cumulative record of Chinese gaming and entertainment platforms targeted during that period, highlighting the value attackers place on large user databases regardless of sector.

Were you affected?

Readers concerned about this or similar incidents can take the following initial steps:

• Change passwords on any accounts that reuse credentials from the affected period, prioritising services that still accept the same email address.
• Enable multi-factor authentication wherever available to reduce reliance on password strength alone.
• Run a free exposure scan of their email address against known breach data to determine whether their information appears in public repositories.

AICompiled with AI assistance from public sources and published under our editorial standards.