Tunngle tunngle.net Tunngle data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In 2016, the now defunct gaming network Tunngle was breached. Have I Been Pwned lists 8,192,928 accounts, with email addresses, IP addresses, usernames and salted MD5 password hashes exposed. It was added to the site in October 2023.
View all 13,118 breaches- Breach date
- Jul 2016
- Affected
- 8,192,928
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Tunngle was a global LAN gaming network that let players connect over the internet as if they shared a local network. In 2016 it suffered a data breach. Have I Been Pwned (HIBP) lists 8,192,928 accounts, and added the data to its index on 21 October 2023. HIBP describes the service as now defunct.
Sources checked: haveibeenpwned.com, web.archive.org, consumer.ftc.gov
Last verified against the official page:
What was exposed
According to HIBP, the data included email addresses, usernames, IP addresses and passwords stored as salted MD5 hashes. A salted hash is not the plain password, but a leaked hash can still be attacked offline, and an old password that is easy to guess is the most exposed.
What it means for you
An email address and username together let a scammer address you by your gaming handle in a phishing message. An IP address gives a rough location of where you connected from at the time. The bigger risk is password reuse: if you used the same password on another account, an attacker can try it there.
The company's response
The service no longer operates, so there is no company notice or support page to point to. HIBP's entry is the main public record of the breach, and the original Tunngle site survives only in an archived copy.
What to do if you were in it
- 1
Change the password and anywhere you reused it
If you used your Tunngle password on any other account, change it there now, and use a different password for each account. A password manager makes that easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your important accounts, starting with email. It blocks most takeovers even when a password has leaked. The FTC lists this among its post-breach steps.
- 3
Expect scam messages
With your email address and gaming username out there, scammers can send convincing phishing emails and texts. Don't click links in unexpected messages; go to the company's site yourself.
- 4
Check where else your details have leaked
To see which other breaches include your email or phone, run a free Serus scan.
Frequently asked
Was I affected by the Tunngle breach?
Check your email address on Have I Been Pwned. If it is listed under Tunngle, your data was in the 8,192,928 accounts HIBP loaded.
What was exposed in the Tunngle breach?
Email addresses, usernames, IP addresses and salted MD5 password hashes, according to HIBP.
Should I change my password?
Yes, if you ever reused your Tunngle password anywhere else. Change it on those accounts and use a unique one for each.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
