All Breaches
March 1, 2016 Verified Gaming

Nordic Games Data Breach

The 2016 Nordic Games data breach occurred in March 2016 when the official vBulletin discussion forum of Austrian video game publisher Nordic Games (nordicgames.at, which subsequently rebranded as THQ Nordic) was compromised and leaked online.

157.8 Thousand
Reported Records
4
Data Types
High
Severity
Oct 10, 2026
Last updated

Protect Yourself

Check whether you were affected by this breach

Check my email

Exposed Data Types

4
  • Email addresses
  • Usernames
  • Passwords
  • IP addresses

About This Breach

What information was affected in the Nordic Games incident?

The leaked forum membership dump (NordicGames.at_vB_2016-03 (157k+ Users).txt) incorporates community members across historical JoWooD, DreamCatcher, and Nordic Games franchises. The incident compromised records for 157,816 unique players, exposing:

  • Account Identifiers: Discussion forum usernames.
  • Contact Credentials: Canonical email addresses across European domestic providers (t-online.de, gmx.de, web.de) and international mail platforms.
  • Authentication Secrets: Salted MD5 password hashes and per-user cryptographic salts.
  • Network Telemetry: Logged client IP addresses.

How many accounts were affected?

Rigorous RFC canonical parsing and deduplication confirmed 157,816 unique valid email addresses.

Technical analysis and security risks

The exposure stems from unpatched vBulletin vulnerabilities enabling full extraction of the member credentials table. Salted MD5 hashes are susceptible to offline brute-force attacks, posing heightened credential-stuffing risks across primary gaming platforms and storefronts.

Recommended actions for affected users

Former members of the Nordic Games forums should:

  • Immediately change passwords on any active gaming storefront or personal email account where their forum password was shared.
  • Activate multi-factor authentication (MFA) across all digital distribution accounts.

Verification and editorial method

LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.

Report missing or incorrect information