Funny Games Data Breach (2018): What Was Exposed & What To Do

In April 2018 the online entertainment site Funny Games suffered a data breach that exposed 764,000 user records. The incident was disclosed to the company in July 2018, at which point it confirmed the event and attributed it to legacy code that was no longer in use. The affected records represent roughly half of the site’s user base.

What happened

The breach occurred in April 2018. Public reporting of the incident dates to 28 April 2018. The compromised dataset contained 764,000 records that included usernames, email addresses, IP addresses and salted MD5 password hashes. Company notification took place in July 2018; at that time Funny Games acknowledged the breach and stated that it originated from legacy code no longer active on its systems. No further technical details about the intrusion method or timeline have been released.

How a breach like this happens

Incidents involving older application code often begin with the discovery of unpatched vulnerabilities or retained credentials in systems that remain accessible even after they are no longer supported. Attackers may obtain initial access through exposed services, compromised third-party components or reused credentials. Once inside, they can extract database contents that include account identifiers and password hashes. In many cases the organisation learns of the event only after the data appear on public forums or after external researchers notify the company.

Funny Games and its sector

Funny Games operates an online entertainment platform that requires users to create accounts for access. Organisations in this sector routinely store account credentials, contact information and connection metadata to manage logins, prevent abuse and deliver services. A breach at such a site therefore places personal identifiers and authentication data at risk for a large number of individuals who may also maintain accounts on other platforms with similar credentials.

What was likely exposed

The breach record lists usernames, email addresses, IP addresses and salted MD5 password hashes. The exact scope of additional fields, if any, remains undisclosed. Organisations of this type commonly retain the following categories of data:

• Account identifiers such as usernames
• Contact details including email addresses
• Network information such as IP addresses at time of access
• Authentication data in the form of password hashes

Whether any of these additional categories were present cannot be confirmed from available information.

Why it matters

Exposure of email addresses and usernames can facilitate targeted phishing or account-enumeration attempts. Salted MD5 hashes are weaker than current standards; if the salts are also obtained, offline cracking becomes feasible for passwords that are short or commonly used. IP addresses may reveal approximate locations or allow correlation with other datasets. For the organisation, the incident highlights the persistence of legacy code as a source of retained risk even after systems have been decommissioned.

If your data was in this breach

Change the password on the Funny Games account and on any other service where the same password was used. Enable multi-factor authentication wherever available. Monitor email accounts for unsolicited messages that reference the breach. Readers can run a free exposure scan of their email address against known breach datasets to determine whether their information appears in this or other public records.

AICompiled with AI assistance from public sources and published under our editorial standards.