Note : BMG stated that were stored or compromised, as these are handled by third-party processors. Town of Salem hack exposes details of 7.6 million gamers
Always activate 2FA wherever available. Even if a hacker finds your password on a Pastebin dump, they cannot log in without the secondary token sent to your authenticator app.
| Date | Event | | :--- | :--- | | | The vulnerable backup script is active on BMG servers. | | December 26, 2018 | A user on the Town of Salem Discord server alerts staff to the vulnerability, claiming they have accessed the database. Staff initially dismiss or ban the user. | | December 28, 2018 | The attacker uploads the database contents to Pastebin. The paste is shared widely across Reddit and Discord. | | December 28–29, 2018 | The community backlash begins. Users verify the breach by searching the Pastebin for their own emails and passwords. | | December 29, 2018 | BMG issues a statement acknowledging the breach and forces a password reset for all users. | town of salem data breach pastebin
To facilitate maintenance, BMG utilized a script that created backups of the game's database. This script generated a compressed file (typically a .tar.gz or .zip archive) containing the MySQL database.
The developer's response was met with mixed reviews. Many players felt the communication was delayed, as reports of the breach had circulated on community forums like Reddit before an official statement was released. Once the breach was confirmed, BMG took several steps: Note : BMG stated that were stored or
Linking real-world digital identities to in-game personas.
The last known connection points of the users. | Date | Event | | :--- |
The data breach at the game's developer, , was first discovered and disclosed on December 28, 2018 . On that day, the hacked database lookup site DeHashed received an anonymous email containing evidence of a server compromise and a complete copy of the game's user database, which included information belonging to over 7.6 million players. The total row count of the stolen data was a staggering 8,388,894, with 7,633,234 unique email addresses.
Expect an increase in "official-looking" emails asking for login details; hackers often use leaked emails to target victims.