SubaGames 2017

Data from the forum of SubaGames, an online gaming platform, circulated among cybercriminals in 2017, according to our investigation team's records, which list roughly 2.3 million rows tied to subagames.com with an estimated breach date of January 1, 2017. The listing fits a wider pattern: reporting by Hackread in March 2017 documented a hacker using the handle "Cfnt" selling account data from 25 forums running outdated vBulletin 4.x software, with subagames.com among them. The flaw, reported to vBulletin in June 2016, allowed SQL injection attacks through the Forumrunner add-on, and forums running older versions were easy to find with simple search techniques.

Limited public reporting: As of September 25, 2026, detailed company notices or major news coverage for this listing were limited in sources reviewed. The facts below rely primarily on the indexed fields plus any secondary sources cited.

Breach Timeline

November 2016: Hackread reported the Suba Games forum was hacked, with accounts later offered for sale on a dark web marketplace. Mozilla Monitor dates the SubaGames breach to November 1, 2016.

March 25, 2017: Hackread reported that data from 25 breached vBulletin forums, including subagames.com, was being sold on the Hansa dark web marketplace.

What Information Was Compromised?

Our analysis found the following data types in this breach: email addresses. Our records do not specify how many email addresses are included in this dataset.

Hackread's reporting on the Suba Games forum data, based on a scan of the dark web listing, described the stolen records as containing usernames, passwords, user IDs, security questions, IP addresses, and dates of birth. Hackread reported the forum data included both decrypted and still-encrypted accounts.

Not every individual is affected by every type of data listed here.

What Are the Potential Risks for Affected Individuals?

Passwords are the central risk in this breach. Anyone who reused a SubaGames forum password on email, banking, gaming, or social media accounts faces a real chance of unauthorized logins through credential stuffing, where attackers feed leaked email and password pairs into other sites until one works.

Security questions exposed in a forum database can also undermine account recovery on unrelated services, since answers like a birthplace or first pet rarely change. Email addresses paired with other personal details are useful for targeted phishing: a message that references a gaming account or includes partial personal information is more convincing than generic spam. Data such as IP addresses and dates of birth adds to that profile, even though it cannot directly unlock an account.

What Should You Do If You Were Affected?

Change your SubaGames password immediately, and anywhere else you used the same or a similar password.

Turn on two-factor authentication for your email and any account that offers it, especially financial services.

Update your security questions on other accounts if the answers you used there match what you registered with the SubaGames forum.

Watch for phishing emails that reference gaming accounts, and avoid clicking links or entering credentials from unsolicited messages.

Check whether your email address appears in this or other breaches using a reputable lookup service, and consider a password manager to keep future credentials unique.

Because the source of this data is an outdated forum platform rather than a current account system, the most important step is protecting accounts that share a password with the forum, not the forum itself.