R2Games Data Breach (2015): What Was Exposed & What To Do
SourceBreach data provided in part by Have I Been Pwned, used under CC BY 4.0.
The R2Games Data Breach (2015) (reported November 1, 2015) exposed Email addresses, IP addresses, Passwords and Usernames belonging to roughly 22.3M people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
What happened
The incident involved unauthorized access to a vBulletin forum operated by R2Games. More than 2.1 million personal records were disclosed in the initial release. Passwords were stored as salted hashes that used a weak implementation, allowing many to be cracked. Subsequent additions of 11 million accounts in March 2016 and 9 million accounts in July 2016 brought the cumulative total above 22 million.
Exact details on the method of initial access, the duration of unauthorized activity, and the identity of those responsible remain undisclosed in public reporting.
How a breach like this happens
Incidents involving online forums commonly begin with the exploitation of known software vulnerabilities or weak administrative controls. Once inside the environment, attackers can extract database tables that contain user credentials and associated metadata.
Where password storage relies on outdated hashing methods, even salted values can be processed offline at scale, converting a portion of the data into usable plaintext. The resulting files are then sometimes posted or traded on public or semi-public channels.
R2Games and its sector
R2Games operates an online gaming platform that includes user forums for discussion and account management. Organizations in this sector routinely collect identifiers such as usernames and email addresses to support registration, login, and communication with players.
A compromise at a gaming service can affect large numbers of accounts because these platforms often maintain long-lived user bases and store persistent login data. The exposure of IP addresses alongside credentials adds location-related metadata that is not always present in other breach types.
What data was at risk
The records that surfaced included email addresses, IP addresses, passwords, and usernames. The precise scope of every field contained in the disclosed files has not been independently verified beyond these categories.
- Email addresses
- IP addresses
- Passwords (stored as salted hashes)
- Usernames
The real-world impact
Individuals whose records appeared may face attempts to access other online accounts if the same credentials or email addresses were reused elsewhere. Cracked passwords increase the likelihood of direct account takeover on services that do not enforce additional verification.
For the organization, the incident required remediation of the forum software and password storage practices. No financial loss figures or regulatory penalties have been publicly detailed in connection with this event.
Were you affected?
Users of R2Games accounts active before late 2015 can check whether their email address appears in known breach datasets by running a free exposure scan through a reputable service such as Have I Been Pwned. Changing passwords on the affected service and any other sites that share the same credentials is a prudent first step, along with enabling any available two-factor authentication options.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Trillian Data Breach (2015)QuinStreet Data Breach (2015)Aternos Data Breach (2015)The Fappening Data Breach (2015)Latest breaches
Read GalaxyWarden’s full analysis of the R2Games Data Breach (2015) →
Verified breach. Breach data provided in part by Have I Been Pwned, used under CC BY 4.0.
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.