Breach Disclosure: GoGames

In December 2019, manga website GoGames was breached. 3.9 million user email and IP addresses, usernames, and salted MD5 hashed passwords were exposed. Site administrators have not responded to requests for comment regarding the breach. This is not the first time the site has been breached - in October 2015, the site exposed the same data for 3.4 million users.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

This breach occurred in December 2019, however, data has since been made publicly available. The breach dump is now being offered for sale on RaidForums.

Figure 1. Sale ad for GoGames dump on RaidForums

There are conflicting reports on the date that this breach occurred, with some sources claiming that this breach is from 2015. However, it appears that this breach is recent, and that the December 2019 date is the correct one.

Given that this is the second major breach of this site and that site admins have not released a statement regarding improvements to the security of the site, ZeroFOX would caution potential users against making a profile on this site.