Dungeons & Dragons Online data breach
From Breaches, in the HARD wiki · Updated
This article is about the April 2013 breach of Dungeons & Dragons Online. For every breach, see Breaches.
The Dungeons & Dragons Online data breach exposed 1,580,933 accounts from ddo.com in April 2013. The data taken includes passwords, usernames, dates of birth and email addresses and 2 more kinds of data.[1]
Have I Been Pwned verified it and added it to its search on 12 Mar 2016, 3 years later. It is the 338th largest of the 618 breaches in HARD’s list.
What was exposed
Dungeons & Dragons Online’s breach included 6 kinds of data. What each lets criminals do:
| Data | What it’s used for |
|---|---|
| Passwords | Criminals try leaked passwords on email, banking and shopping sites, because people reuse them. |
| Usernames | Half of a login. With a reused password, it opens other accounts. |
| Dates of birth | Used to prove who you are to banks and phone companies. |
| Email addresses | Expect scam emails that name the company to look genuine. |
| IP addresses | Roughly where you were when you used the service. |
| Website activity | Personal details that make scam messages more convincing. |
What to do
- Check whether you’re in it.Search your email address on Have I Been Pwned. It tells you which breaches it appears in, Dungeons & Dragons Online among them, without showing the data.
- Change your Dungeons & Dragons Online password.If the account still exists, sign in at Dungeons & Dragons Online (ddo.com) and change it.
- Change it anywhere you used the same one.Start with your email, then banking and shopping. Leaked passwords are tried on other sites automatically, within days.
- Use a password manager and two-step sign-in.A different password for every site means one breach can’t open the rest. Two-step sign-in stops a leaked password working on its own.
- Distrust messages that mention Dungeons & Dragons Online.Scammers use breach data to sound genuine. Don’t click links in emails or texts about the breach; go to the site yourself.
Timeline
- : the breach, as best it can be dated.
- : Have I Been Pwned verifies the data and adds it to its search, 3 years later.
Breaches often stay hidden for a long time. Until it came out, people in it had no reason to change anything.
Similar breaches
Breaches that leaked the same kinds of data, closest in time:
- Neopets, May 2013, 27 million accounts
- BookCrossing, November 2012, 1.6 million accounts
- Malwarebytes, November 2014, 111,623 accounts
- Sony, June 2011, 37,103 accounts
- Yam, June 2013, 13 million accounts
- Funimation, July 2016, 2.5 million accounts
See Breaches for all 618, and Updates for keeping your devices patched.
References
- ^ Troy Hunt. “Dungeons & Dragons Online”, Have I Been Pwned, added 12 Mar 2016. Breach data licensed CC BY 4.0.
External links
- Have I Been Pwned, to check your email address
- ddo.com, Dungeons & Dragons Online’s website