VNG Data Breach (2015): What Was Exposed & What To Do

In 2015, a data breach at VNG exposed personal information belonging to 24.9 million people. The incident remained largely unnoticed by the public until April 2018, when the data appeared on a hacking forum and was later shared with breach-tracking services. The records included dates of birth, email addresses, genders, IP addresses, marital statuses, names, occupations, and passwords. No further details on the method of access or the precise date of the intrusion have been disclosed.

What happened

The breach is recorded as occurring in May 2015. Public reporting of the event began on 19 May 2015, yet the data set did not surface widely until it was observed being traded on a hacking forum in April 2018. The collection, containing 24.9 million records, was subsequently supplied to Have I Been Pwned by dehashed.com. No official statement from VNG detailing the intrusion timeline, attacker activity, or total records involved beyond the 24.9 million figure has been made public.

How a breach like this happens

Incidents involving large user databases often begin with an attacker obtaining access to an organisation’s internal systems, either through stolen credentials, unpatched software, or misconfigured servers. Once inside, the attacker can copy tables that store account details. The data may then be packaged and offered for sale or exchange on closed forums. Because many organisations reuse similar database structures, the same categories of fields—names, contact information, and password hashes—frequently appear in such leaks.

Who is VNG?

VNG is a Vietnamese technology company that operates consumer internet services, including messaging, gaming, and social platforms. Like other firms in this sector, it maintains accounts for millions of users and therefore stores the personal details required for registration and service delivery. A breach at such a company is consequential because the records can be combined with data from other sources to build detailed profiles of individuals.

What was likely exposed

The breach record lists the following data types as present: dates of birth, email addresses, genders, IP addresses, marital statuses, names, occupations, and passwords. The exact contents of every record remain unconfirmed, and it is not known whether additional fields such as home addresses or financial information were also taken. Passwords appear in the data set, though the hashing method used has not been specified in the available reporting.

The real-world impact

Individuals whose information appears in the data set face the possibility that their email addresses and passwords could be tested against other online accounts. Names, dates of birth, and occupations can assist in targeted phishing or social-engineering attempts. For the organisation, the incident adds to the body of known breaches involving Vietnamese technology services and may prompt users to review password reuse across platforms. No confirmed cases of subsequent fraud directly attributed to this data set have been documented in the reporting.

Were you affected?

Anyone who created an account with VNG services around or before 2015 can check whether their email address appears in public breach data by using a free exposure scan. Practical next steps include changing passwords on the affected service and any other sites where the same password was used, and enabling multi-factor authentication where available. Monitoring for unusual login attempts or unsolicited messages that reference personal details from the records is also advisable.

AICompiled with AI assistance from public sources and published under our editorial standards.