Galactic Games 2021 Data Breach Claim

The archive filename carries the Galactic Games attribution, but no operator statement, independent incident report, or current a public breach source record was located; the galacticgames.co.uk attribution and incident date therefore remain unverified. The existing March 2021 date is retained only as an unsupported legacy month-level catalogue marker and is not presented as the date of access, exfiltration, or publication.

Two independent compiled parsers exhaustively inspected all 50,110 nineteen-field rows in the 9,489,140-byte SQL member. The official OpenCart 1.5.6.4 oc_customer schema binds zero-based field 4 to email through an exact nineteen-column match. The field produced 50,082 canonical-valid occurrences, 28 rejected values, and 50,079 unique canonical emails. Name, telephone, password, password-salt, and IP fields exist in the source schema; none of them were imported into LeakData search. Only email relations are in search scope.

The historical job completed on 2 July 2026 and records 50,049 valid lines and 50,049 imported emails; live Mongo also contains 50,049 unique relations. The historical normalized input no longer exists, however, and the job has neither an input manifest nor a source SHA-256. The current archive and live set are not identical: 42 current-valid source email values are absent live, while 12 live values are absent from the current canonical source set. Ten of those twelve pass the current validator and two were accepted by the legacy validator but fail the current local-dot rule. No additive import was performed and no existing relation was deleted because doing so would mix unresolved source versions.

The 50,110 raw SQL rows are not a people count, and neither the 50,079 source emails nor the 50,049 live relations are presented as a verified affected-person count. No reliable external scope authority was located, so no pwnCount is published. The current a public breach source exact lookup returned 404 and the public list had no match; absence is not treated as disproof. An email match alone does not prove account ownership, purchases or gaming interests, co-occurrence of other fields, or misuse.