gPotato Data Breach

A public breach source catalogues 2,136,520 accounts or unique emails with usernames, emails, IPs, names, birth dates, gender, physical addresses, site activity, Hashed passwords, and plaintext security questions and answers. July 12 is a structured dataset date, while the narrative states only July 2007.

The local import normalized only the second-column emails from gpotato.txt and produced 2,135,811 unique emails, 709 below a public breach source's measure. The SQL dump and every non-email field were excluded. Because the source and normalized files and backup are missing, schema and transformation cannot be re-audited.

A private result establishes only that the controlled email occurs in the local email subset. It cannot establish identity, a current or past gPotato or Webzen account, player or forum status, IP or location, name, birth date, gender, address, username, password or security answer, field co-occurrence, compromise, or misuse.

MD5 is not plaintext, although a weak password may be guessed; plaintext security answers are more sensitive. Only a known password or security answer still reused elsewhere should be changed. The 2016 status suggesting accounts had migrated to Webzen must not be treated as confirmed current in 2026.