GameSprite gamesprite.me GameSprite data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In December 2019, the now defunct gaming platform GameSprite was breached. Have I Been Pwned lists 6,164,643 accounts, with email addresses, IP addresses, usernames and salted MD5 password hashes exposed. It was added to the site in October 2023.
View all 13,118 breaches- Breach date
- 17 Dec 2019
- Affected
- 6,164,643
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
GameSprite was a gaming platform that is now defunct. In December 2019 it suffered a data breach. Have I Been Pwned (HIBP) lists 6,164,643 accounts and added them on 30 October 2023, almost four years after the breach date. HIBP reports over 6 million unique email addresses.
Sources checked: haveibeenpwned.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
HIBP says the impacted data included email addresses, usernames, IP addresses and salted MD5 password hashes. No names, phone numbers or payment details are listed.
What it means for you
The email and username pair is enough to target you with a phishing message that uses your gaming handle. IP addresses can hint at your rough location when you used the service. If you reused your GameSprite password, an attacker who cracks the hash can try it on other accounts, so that is the part to fix.
The company's response
The platform no longer runs, so there is no breach notice from the company. HIBP's entry is the public record. You can look up your own email there at no cost.
What to do if you were in it
- 1
Change the password and anywhere you reused it
If you used your GameSprite password on any other account, change it there now, and use a different password for each account. A password manager makes that easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your important accounts, starting with email. It blocks most takeovers even when a password has leaked. The FTC lists this among its post-breach steps.
- 3
Expect scam messages
With your email address and username out there, scammers can send convincing phishing emails and texts. Don't click links in unexpected messages; go to the company's site yourself.
- 4
Check where else your details have leaked
To see which other breaches include your email or phone, run a free Serus scan.
Frequently asked
Was I affected by the GameSprite breach?
Look up your email on Have I Been Pwned. If GameSprite appears, you were among the 6,164,643 accounts HIBP lists.
What was exposed in the GameSprite breach?
Email addresses, usernames, IP addresses and salted MD5 password hashes, per HIBP.
Are my passwords safe?
The passwords were stored as salted hashes, not plain text. Treat any password you reused as exposed and change it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
