OnRPG Data Breach (2016): What Was Exposed & What To Do

Breaking down the breach

The breach was reported on 1 July 2016. It affected the now-defunct OnRPG site, a free online games listing platform. The exposed records contained email addresses, IP addresses, usernames, and passwords stored as salted MD5 hashes. The total number of individuals affected is stated as 1.0 million. No further details on the date of the intrusion itself, the method of access, or the volume of any files taken have been disclosed in the available reporting.

How a breach like this happens

Incidents involving online service accounts commonly begin with an attacker gaining unauthorised access to a web server or database, either through a vulnerability in the application code, weak administrative credentials, or an exposed management interface. Once inside, the attacker can copy user tables that contain login details and associated metadata such as IP addresses recorded at the time of registration or login. Passwords stored as salted MD5 hashes remain protected against immediate plaintext recovery but can be subjected to offline cracking attempts if the salt values and hash lists are obtained.

About OnRPG

OnRPG operated as a directory and community site for free-to-play online games. Sites of this type typically allowed users to create accounts to post comments, track games, or receive newsletters. Such platforms collect the minimal set of identifiers needed to manage accounts and combat abuse, which explains the presence of email addresses, usernames, and IP logs alongside password hashes. Because the service is no longer active, any ongoing monitoring or notification processes that might once have existed are no longer available to affected users.

The information in question

The breach is reported to have exposed email addresses, IP addresses, usernames, and passwords stored as salted MD5 hashes. No other categories of personal information, such as full names, payment details, or private messages, are named in the available facts. The precise contents of any redistributed data set remain unconfirmed beyond these four fields.

Why it matters

Email addresses paired with usernames and IP addresses can be used to link individuals across other services and to map online activity over time. Password hashes, even when salted, may be cracked if users chose common or reused passwords, potentially allowing unauthorised access to accounts on other sites where the same credentials were employed. For the organisation, the incident illustrates the long-term persistence of data once it leaves the original environment, regardless of whether the site itself continues to operate.

Were you affected?

Individuals who recall creating an account on OnRPG can treat their email address as potentially exposed and change passwords on any other services where the same email and password combination was used. Enabling unique passwords and a password manager reduces the impact of any single breach. Readers may also run a free exposure scan of their email address against known breach data sets to check for additional appearances of the same address.

AICompiled with AI assistance from public sources and published under our editorial standards.