gPotato Data Breach (2007): What Was Exposed & What To Do

Inside the incident

The breach was reported on July 12, 2007. Public records state that over 2.1 million user accounts were exposed. The affected site later merged into the Webzen portal, where the original accounts remain accessible. No further details on the method of access, exact timeline of the intrusion, or subsequent actions by the organization were disclosed in available reporting.

How a breach like this happens

Incidents involving online service accounts often begin with attackers gaining unauthorized entry through vulnerabilities in web applications, weak authentication controls, or compromised third-party systems. Once inside, data is extracted from databases that store user credentials and profile details. Passwords may be held as hashes, while other fields such as addresses or security questions can be stored without additional protection, allowing direct access if the database is reached.

gPotato and its sector

gPotato operated as a portal for multiplayer online games, a sector that routinely collects account registration data to manage user identities and access. Organizations in this space maintain records including contact information, demographic attributes, and login credentials to support gameplay and account recovery. A breach at such a service can leave long-lived accounts exposed because many users retain the same credentials across platforms even after site mergers or rebranding.

What data was at risk

The reported exposure included usernames, email addresses, IP addresses, passwords stored as MD5 hashes, and personal attributes such as gender, birth date, physical address, and security questions and answers stored in plain text. Exact confirmation of every field for all accounts is not available from public summaries.

• Dates of birth
• Email addresses
• Genders
• IP addresses
• Names
• Passwords (MD5 hashes)
• Physical addresses
• Security questions and answers (plain text)

What's at stake

Individuals whose information appeared in the dataset face the possibility that hashed passwords could be tested against common values and that plain-text security answers could aid further account access attempts. The organization may encounter ongoing support requests from users whose credentials appear in later compilations of breach data. Because the accounts continue to exist on the successor platform, any reuse of the exposed details could affect current logins.

If your data was in this breach

Review any gPotato or Webzen accounts still in use and update passwords to unique values. Enable any available account recovery options and monitor associated email addresses for unexpected activity. Readers can run a free exposure scan of their email address to check whether their information has surfaced in known breach data.

AICompiled with AI assistance from public sources and published under our editorial standards.