Breach Disclosure: Emuparadise

In April 2018, Emuparadise, a retro gaming and ROM website, suffered a data breach of their vBulletin system. An article written by ZDnet stated that the breach contained approximately 1,131,229 email addresses, usernames, IP addresses and md5 salted passwords. The website itself gained notoriety for hosting ROMs of old and retro games, and has recently switched over to only hosting emulators of these old gaming systems.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

The security incident happened on or around April 2018. The databreach website dehashed originally had the data and shared it with others after a year. Although the passwords were salted, md5 is a cryptographic hash algorithm known to have weaknesses that make it much easier to brute force than modern cryptographic hash algorithms.

One user on a forum thread on epforums.org noted that "..The breach is over a year old, and as far as I can tell Emupara forces password changes every year also, so it's pretty much a non issue". Although password changes are generally good security practice, many users reuse their passwords across multiple websites, and the email addresses provide spammers and cybercriminals target lists to issue additional attacks.