Breach Disclosure: Game Salad

Breach Disclosure: GameSalad

In early 2019, game development community website GameSalad suffered a security breach. This breach was part of Round 4 of gnosticplayers data breach escapades. As of today's date (July 22 2019), we could not find any confirmation from GameSalad themselves. 1.5 million accounts were compromised, and the breach contained email and IP addresses, usernames and passwords stored as SHA256 hashes.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media

Details

The ZDNet article showed a table of all of the companies affected in Round 4 of gnosticplayers breach sale. For 26.42 million records, the asking price at the time was only $4,940. In correspondence with the reporters, the data fencer claimed that he had more data to sell, but companies responded to his extortion demands, so therefore the data would not be put up for sale.