Full Report
In December 2019, the now defunct gaming website Unigame (maker of Hunter Online) suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 844k email addresses and salted MD5 password hashes.
Analysis Summary
# Incident Report: Unigame Data Breach (2019)
## Executive Summary
In December 2019, the defunct gaming website Unigame, creator of Hunter Online, suffered a significant data breach resulting in the exposure of 844,000 user records. The compromised data included email addresses and associated password hashes (salted MD5). This breach was later resurfaced as part of a larger data corpus. The primary response involves advising affected users to immediately change their passwords and enable two-factor authentication where supported.
## Incident Details
- **Discovery Date:** Data was later observed being redistributed publicly (specific initial breach discovery date unclear, but added to HIBP on 8 Aug 2025 according to HIBP data integration).
- **Incident Date:** December 2019
- **Affected Organization:** Unigame (Defunct gaming website, maker of Hunter Online)
- **Sector:** Gaming/Technology
- **Geography:** Not specified
## Timeline of Events
### Initial Access
- **Date/Time:** December 2019 (Approximate)
- **Vector:** Not specified in the provided text (Implied compromise of Unigame's systems).
- **Details:** Unknown initial entry method.
### Lateral Movement
- **Status:** Not specified in the provided text.
### Data Exfiltration/Impact
- **What was stolen or damaged:** 844,000 email addresses and their corresponding passwords, stored as **salted MD5 hashes**.
### Detection & Response
- **How it was discovered:** The breach data was later identified and integrated into larger data leak corpuses, eventually being listed on Have I Been Pwned (HIBP).
- **Response actions taken:** Public advisory suggesting users change passwords and enable 2FA.
- **Date of HIBP addition:** 8 August 2025 (Note: This date likely relates to when the data was indexed by HIBP, not the original breach incident).
## Attack Methodology
*(Note: As this is a historical breach summary based on exposed data, the specific TTPs of the attacker during the initial compromise are not detailed in the source material.)*
- **Initial Access:** Unknown/Not specified.
- **Persistence:** Unknown/Not specified.
- **Privilege Escalation:** Unknown/Not specified.
- **Defense Evasion:** Unknown/Not specified.
- **Credential Access:** Direct access/theft of password hashes.
- **Discovery:** Unknown/Not specified.
- **Lateral Movement:** Unknown/Not specified.
- **Collection:** Gathering PII (Email) and authentication secrets (Password Hashes).
- **Exfiltration:** Data was exfiltrated and later redistributed.
- **Impact:** Compromise of user credentials.
## Impact Assessment
- **Financial:** Not specified.
- **Data Breach:** 843.7 thousand records compromised, including email addresses and salted MD5 password hashes.
- **Operational:** Business disruption is unknown as the organization is now defunct.
- **Reputational:** Negative reputational impact associated with data mishandling.
## Indicators of Compromise
- **Network indicators:** None provided (defanged).
- **File indicators:** None provided.
- **Behavioral indicators:** None relevant to defenders, as the incident is historical and the organization defunct.
## Response Actions
- **Containment measures:** Not applicable retroactively to the organization. External containment focuses on user remediation.
- **Eradication steps:** Not applicable retroactively.
- **Recovery actions:** Users advised to change passwords on services where the same credential combination was used.
## Lessons Learned
- **Key takeaways:** Storing passwords using the older MD5 hashing algorithm, even when salted, offers significantly reduced security compared to modern, computationally expensive hashing algorithms (like Argon2 or bcrypt).
- **What could have been done better:** The organization, while defunct, failed to adequately protect credentials, leading to long-term exposure when the data was reused in other breaches.
## Recommendations
- **Prevention measures for similar incidents:**
1. Implement modern, robust password hashing functions (e.g., Argon2, bcrypt) with appropriate work factors.
2. Mandate the use of Multi-Factor Authentication (MFA/2FA) across all user accounts.
3. Establish protocols for securing and immediately wiping user data if a service is being intentionally shut down.