Multiplayer.it Data Breach (2018): What Was Exposed & What To Do

In 2018, the Italian gaming website Multiplayer.it experienced a data breach that affected 504,000 user records. The incident was not publicly reported at the time. In April 2024 the same records appeared on a hacking forum, prompting Multiplayer.it to confirm that the breach had occurred six years earlier and that the 2024 posting was a re-release of the original data. The exposure involved email addresses, usernames and salted MD5 password hashes. No further technical details about the intrusion or its discovery have been released by the organisation.

What happened

The breach took place in September 2018. Records containing email addresses, usernames and salted MD5 password hashes for 504,000 accounts were removed from Multiplayer.it systems. The company did not announce the incident when it occurred. In April 2024 the same dataset was posted to a popular hacking forum. Multiplayer.it subsequently verified that the data originated from the 2018 intrusion and had simply been re-shared.

How a breach like this happens

Incidents involving the extraction of user account data from websites commonly begin with an attacker obtaining unauthorised access to an organisation’s servers or databases. Once inside, the attacker can copy tables that store login credentials. In many older systems, passwords were stored as MD5 hashes, sometimes with an added salt value intended to slow down automated cracking attempts. If the attacker also obtains usernames and email addresses, the resulting dataset can be used or traded without further interaction with the original site.

Who is Multiplayer.it?

Multiplayer.it is an Italian website focused on video games and related community features. Sites of this type maintain user accounts so that visitors can comment, participate in forums and access personalised content. They therefore hold the basic identifiers and credentials needed to manage those accounts. A breach at such a service is consequential because many users register with email addresses they also use elsewhere and may reuse passwords across multiple platforms.

The information in question

The records posted in 2024 contained email addresses, usernames and salted MD5 password hashes. The exact scope of any additional fields that may have been present in the original database remains undisclosed. Organisations that operate gaming and community websites typically store these three categories of data to support account creation and login functions; whether further personal details were taken has not been confirmed.

The real-world impact

Individuals whose records were exposed face the possibility that their email addresses and password hashes could be used in attempts to access other online accounts where the same credentials were reused. Salted MD5 hashes require more computational effort to reverse than unsalted hashes, yet they remain vulnerable to offline attacks with modern hardware. For the organisation, the reappearance of the data six years later renewed attention to an event that had not been addressed publicly at the time of the original intrusion.

What to do if you're exposed

Anyone who used Multiplayer.it should change the password on that account and on any other service where the same password or a close variation was used. Enabling multi-factor authentication on important accounts reduces the value of a leaked password. Checking whether an email address appears in known breach datasets can be done through free exposure scanning services that query public breach repositories.

AICompiled with AI assistance from public sources and published under our editorial standards.