Breach Disclosure: Clash of Kings

Mobile game app Clash of Kings suffered a data breach of its official forum in July 2016. Records related to 1.6 million accounts were leaked, inclusing usernames, email and IP addresses, device identifiers, and salted hashed passwords.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Remain alert to potential spear phishing attacks through email and social media.

Details

Clash of Kings, a popular mobile gaming application, had its official forum breached in July 2016. Nearly 1.6 million user records were exposed as a result. The attacker responsible for the breach was able to exploit the company's lax security policies. The company did not elect to use even basic HTTPS encryption, and built the forum on an old version of vBulletin which contains a security vulnerability dating back to 2013. This vulnerability is easily exploited, and was used to access the databases involved in this breach.