Loading story…
Club Penguin Rewritten, an independent recreation of Disney's Club Penguin, suffered two major data breaches that exposed account data from its user base. The first incident, in January 2018, affected nearly 1.7 million unique email addresses, along with usernames, IP addresses, and passwords stored as bcrypt hashes; the site said at the time that it was aware of the breach and had contacted affected users.
A second breach in July 2019 exposed another 4 million unique email addresses and included the same categories of data: email addresses, usernames, IP addresses, and bcrypt-hashed passwords. Combined, the incidents left roughly 5.7 million accounts exposed across the two compromises, underscoring repeated security failures at a gaming platform aimed at children and young users.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
In July 2019, Club Penguin Rewritten experienced another data breach. The later incident exposed 4 million unique email addresses as well as IP addresses, usernames, and bcrypt-hashed passwords.
Following the January 2018 breach, Club Penguin Rewritten stated that it was aware of the incident and had contacted affected users.
In January 2018, Club Penguin Rewritten experienced a data breach that exposed nearly 1.7 million unique email addresses, along with IP addresses, usernames, and bcrypt-hashed passwords.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Flash Flash Revolution, a music-based rhythm game, suffered two major account compromises that together exposed data from roughly **3.7 million** records. In the February 2016 incident, attackers breached the site's **vBulletin forum** and exposed about **1.8 million accounts**, including email addresses, IP addresses, and **salted MD5 password hashes**. A separate breach in July 2019 affected nearly **1.9 million members** and was disclosed as distinct from the earlier compromise. The later incident exposed email addresses, IP addresses, usernames, dates of birth, and **salted MD5 password hashes**, extending the scope of personal data tied to the platform and creating renewed credential and privacy risks for affected users.
Jun 29, 2026
Dragonica Lunaris, a European private server for the MMORPG Dragonica operating at **playdragonica.eu**, disclosed a data breach that exposed about **126,000 user records**. The compromised data included **email addresses, usernames, dates of birth, and `bcrypt` password hashes**, indicating both personal information exposure and credential risk for affected players. The incident occurred in **December 2025** and was later confirmed by the service operator, who said the underlying issue had been fixed. The breach has since been cataloged by **Have I Been Pwned**, bringing broader visibility to the compromise and enabling impacted users to check whether their account data was included.
Jun 29, 2026
A 15.5 GB dataset allegedly sourced from Chess.com was posted for free on an underground forum, containing 7.3 million records and approximately 4.6–4.7 million unique email addresses. The records include usernames, names, countries, and Chess.com account-related information. Have I Been Pwned added the data to its breach corpus but assessed that it was likely collected by scraping publicly accessible Chess.com web or API data rather than by compromising protected Chess.com systems. About 99% of the email addresses had appeared in earlier breach datasets; nevertheless, the combined account details can enable convincing chess-themed phishing, impersonation, and fraud.
Sep 16, 2026