Armor Games Data Breach (2019): What Was Exposed & What To Do

What happened

The breach at Armor Games was reported on January 1, 2019. Public records indicate that 10.6 million email addresses were impacted, along with usernames, IP addresses, birthdays associated with administrator accounts, and passwords held as salted SHA-1 hashes. No information has been released on the method of access, the duration of the intrusion, or whether additional files were involved. The exact timing of when the data was first obtained remains undisclosed.

How a breach like this happens

Incidents involving online service accounts often begin with an attacker gaining unauthorized entry through vulnerabilities in web applications, weak authentication controls, or compromised credentials from other sources. Once inside, the attacker can extract user databases that contain login information and profile fields. Passwords stored with older hashing methods such as SHA-1, even when salted, can become targets for offline cracking attempts if the database is obtained. Organizations may detect such activity only after the data appears in public listings or after internal logs are reviewed.

Armor Games and its sector

Armor Games operates as a web-based platform hosting browser and downloadable games, requiring users to create accounts for features such as progress saving, forums, and community interaction. Platforms of this type routinely collect and retain registration data, login credentials, and technical identifiers to manage accounts and prevent abuse. A breach at such a service can affect a wide user base because game portals often serve millions of registered players who may reuse credentials across other sites.

What data was at risk

The reported exposure included email addresses, usernames, IP addresses, dates of birth for administrator accounts, and passwords stored as salted SHA-1 hashes. Additional fields listed in connection with the incident are bios, genders, and geographic locations. The precise contents of any extracted files have not been independently confirmed beyond these categories, and the status of other potential data types held by the service remains unconfirmed.

Why it matters

Exposed email addresses and usernames can be used for targeted phishing or to identify accounts on other platforms. IP addresses may reveal approximate locations at the time of access. Passwords hashed with salted SHA-1 are more resistant to casual viewing than plaintext but remain subject to determined offline attacks, particularly if users employed common or reused passwords. For the organization, the incident highlights the long-term value attackers place on user databases from entertainment services, which can circulate in underground markets for extended periods.

Were you affected?

Individuals who created accounts on Armor Games prior to 2019 should consider changing passwords on that site and any other services where the same credentials may have been used. Enabling multi-factor authentication where available adds a layer of protection against credential reuse. Running a free exposure scan of an email address against known breach datasets can indicate whether the address has appeared in publicly discussed incidents, though such scans do not cover every unreported event.

AICompiled with AI assistance from public sources and published under our editorial standards.