Evony Data Breach (2016): What Was Exposed & What To Do

In June 2016, records show that the online game Evony suffered a compromise that exposed more than 29 million unique user accounts. The incident resulted in the disclosure of usernames, email addresses, IP addresses, and unsalted MD5 password hashes. Public reports of the event appeared on 1 June 2016, placing it among the larger gaming-sector incidents documented that year. Such events remain relevant because online services continue to hold large volumes of account credentials that can be reused across platforms. When older breaches surface, the data can still be leveraged in credential-stuffing attacks long after the original compromise.

Breaking down the breach

Contemporary accounts state that the Evony service was accessed without authorization, leading to the extraction of account records. The reported dataset contained 29.4 million unique entries. The exposed fields were limited to usernames, email addresses, IP addresses, and MD5 hashes of passwords stored without additional salting. No further technical details about the intrusion method, duration, or subsequent actions by the operators have been made public in the available records.

How a breach like this happens

Incidents involving online services often begin with the exploitation of application vulnerabilities, weak authentication controls, or compromised administrative credentials. Once inside the environment, an actor can query databases that store user account information. In older systems, password data was sometimes stored using unsalted cryptographic hashes such as MD5, which reduces the computational effort required to recover plaintext values if the hashes are later obtained. After extraction, the material may be shared or sold on forums that traffic in stolen records.

Who is Evony?

Evony operates an online multiplayer strategy game that requires users to create accounts for play. Like other services in the gaming sector, it collects identifiers and contact details to manage accounts, enforce rules, and communicate with players. A compromise at a platform of this type is consequential because the data can be combined with records from other breaches to build more complete profiles of individuals who maintain accounts across multiple sites.

What was likely exposed

The documented records list four categories of information: usernames, email addresses, IP addresses, and MD5 password hashes without salt. No additional data types, such as payment details or full names, are identified in the available reporting. Organizations that operate free-to-play games commonly store only the minimal fields needed for account creation and login; however, the precise contents of the Evony dataset remain limited to the four fields noted above.

What's at stake

Individuals whose records appeared in the dataset face an elevated risk that their email addresses and password hashes could be tested against other services. Because the hashes lack salt, automated tools can attempt to recover matching passwords more efficiently than with modern storage methods. For the organization, the incident highlights the long-term retention of legacy authentication data and the potential for reputational and operational costs when older records become public.

Were you affected?

Anyone who created an Evony account before mid-2016 can treat their email address and any reused password as potentially known to third parties. The immediate practical step is to change the password on the Evony account and on any other service that uses the same credentials. Users can also run a free exposure scan of their email address against known breach datasets to determine whether their information appears in additional incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.