HLTV Data Breach

HLTV said a compromised administrator account and an exploit in old code enabled remote server and database access, parts of the database were stolen, and the entire user database was dumped. It logged out all users, requested password changes, and said passwords were protected with bcrypt.

The company did not publish a count or detailed field list. A public breach source separately reports 611,070 dataset accounts or emails and the classes email, name, username, password hashes, and website activity. This is not a count of people, active accounts, or raw rows, and no field should be assumed to co-occur with every email. Website activity is not proof of posts, comments, viewing behaviour, or a professional esports role. A bcrypt hash is not plaintext.

The local searchable subset contains 609,908 email documents; names, usernames, passwords, and activity fields were not imported. A result can establish only that an email occurs in this subset attributed to HLTV. It cannot establish HLTV or Counter-Strike membership, a player, team, or creator role, site activity, password ownership, or misuse, and a negative result covers only the local subset.