League of Legends Data Breach (2012): What Was Exposed & What To Do

In June 2012, League of Legends reported a data breach that affected user accounts on the multiplayer game platform. At the time the service maintained more than 32 million registered accounts, and the incident involved personal data attributes that included encrypted passwords. In 2018 a subset of 339,000 records from that breach surfaced publicly, containing email addresses, usernames and passwords in plain text. The incident illustrates how credentials stored years earlier can reappear after offline cracking attempts, extending the period during which affected individuals may face risks from reused passwords.

What happened

The breach was first reported on 11 June 2012. League of Legends stated that the service had more than 32 million registered accounts at the time and that the incident had exposed various personal data attributes, including passwords that were described as encrypted. No further details on the method or exact scale of the original intrusion were disclosed in the reporting.

In 2018 a 339,000-record portion of the data appeared in public circulation. The records contained email addresses, usernames and passwords in plain text, which were assessed as likely having been obtained by cracking the originally encrypted password values.

How a breach like this happens

Incidents involving online service accounts often begin with an attacker gaining unauthorised access to a database through vulnerabilities in web applications, weak authentication controls or compromised administrative credentials. Once inside, the attacker can copy stored user records.

Passwords are frequently protected by cryptographic hashing at the time of storage. When those hashes later become available to an attacker, they can be subjected to offline cracking attempts using modern hardware and password-guessing techniques. Successful cracks convert the protected values into plain text, which can then be used or traded.

League of Legends and its sector

League of Legends operates a large-scale online multiplayer game that requires users to create accounts for access. Organisations in this sector routinely collect and retain identifiers such as email addresses and usernames to manage accounts, deliver updates and handle support requests.

A breach at a service of this size is consequential because the platform holds credentials that players may reuse across other sites. When those credentials later circulate, the original incident can contribute to account takeovers on unrelated services years afterward.

The information in question

The 2018 subset that became public contained three categories of data. The exact contents of the full 2012 breach remain unconfirmed beyond the categories noted at the time of reporting.

• Email addresses
• Usernames
• Passwords stored in plain text after cracking

What's at stake

For individuals, the primary concern is that email addresses paired with passwords can be tested against other online accounts. Where passwords are reused, this can lead to unauthorised access on unrelated services. Usernames may also assist in targeted follow-on attempts.

For the organisation, the incident highlights the long-term consequences of retaining user data and the importance of password-storage practices that remain resistant to cracking even if records are later exposed.

If your data was in this breach

Individuals can begin by changing passwords on the affected account and on any other services that use the same or similar credentials. Enabling multi-factor authentication where available adds a further control that does not rely solely on the password.

Readers can run a free exposure scan of their email address to check whether their information appears in known breach data sets. Monitoring for unusual login attempts on linked accounts provides an ongoing way to detect misuse.

AICompiled with AI assistance from public sources and published under our editorial standards.