Gaming accounts have quietly become one of the most attacked asset classes on the internet. Akamai’s State of the Internet reports have tracked billions of credential stuffing attempts against gaming platforms in single reporting periods, with the sector routinely ranking among the top three most targeted verticals alongside financial services and retail. The reason is straightforward. A single hijacked account can hold years of purchases, rare cosmetics, currency, linked payment methods, and a resale value that clears easily on gray market storefronts. For attackers running automated login tools, gamers are a soft, lucrative surface.
What Credential Stuffing Actually Is
Credential stuffing is not hacking in the cinematic sense. Attackers take username and password pairs leaked from unrelated breaches, then replay those pairs at scale against other services using automation frameworks like OpenBullet, SentryMBA, or custom Selenium scripts. Success depends on one behavior that remains stubbornly common, password reuse. Verizon’s Data Breach Investigations Report has repeatedly identified stolen credentials as the leading initial access vector in confirmed breaches, and NIST Special Publication 800-63B explicitly recommends screening chosen passwords against lists of previously compromised secrets for this reason.
A practical way to see whether your own credentials sit inside those recycled lists is to check whether a password appears in known breach lists before reusing it anywhere. These tools scan against massive wordlists, essentially huge text files packed with millions of previously leaked passwords, common gaming slang, and string combinations. In credential stuffing, attackers load these lists directly into automated bots to fire thousands of guesses per second at login screens. If you’re curious about how these massive dictionaries are put together by security researchers and ethical hackers, check out the popular SecLists repository on GitHub. Bottom line: if a password shows up even once in a breach corpus, treat it as entirely burned. Attackers already have it saved in their dictionaries, making any account that reuses it an effortless target.
Why Gaming Accounts Are High-Value Targets
Gamers’ accounts (e.g., Steam, Epic Games Launcher, etc.) attract hackers for several reasons:
The first reason is the monetary value associated with their inventory. For example, a rare skin from Fortnite, a rare item from DotA 2, a CS2 knife, a portfolio of Steam trading cards, or gold from RuneScape may be sold for thousands of dollars via third-party markets. In some cases, there have been reported resale values for an individual item in the four and five figures. When compared to a credit card that has been compromised by theft or hacking, a single hacked Steam account that has a large amount of inventory can produce a higher yield. Additionally, while a credit card will typically result in a fraud alert being sent to the bank when a hacker makes unauthorized purchases using it, this is not the case with a compromised Steam account.
Additionally, linked payment methods create opportunities for greater harm. Almost every storefront account on Steam, Epic Games Launcher, PlayStation Network, Xbox Live, Nintendo Network, and Riot retains a saved card or wallet balance. Hackers use these linked payment methods to purchase goods/services; they then transfer those goods/services to “mule” accounts; and finally they sell the goods/services before the original owner even realizes what happened.
In addition to linked payment methods, age and reputation of the account also factor into why gamers’ accounts are so valuable. A ten-year-old League of Legends account that contains history of ranked play or a World of Warcraft account that includes legacy mounts will be more valuable than a new one since neither can be replaced. Likewise, an account that has earned early adopter badges, veteran forum status, or exclusive event rewards may be viewed as a collector’s item within the underground economy.
The Breach Corpora Behind the Attacks
Modern Credential Stuffing Attacks Operate Off Compilations Rather Than New Dumps. Credential stuffers collect and combine all past breaches. The collection known as “Collection #1” was leaked to the public in 2019 and contains around 773 million different email address combinations with approximately 21 million different plaintext password combinations. Since then other collections have been made including what is referred to as “RockYou2021,” and “RockYou2024” that contain over a billion different password combinations (most of those reused from previous breaches and/or generated using word lists).
The collections mentioned above are used by Botnets to attack Gaming Platforms. An operator of a botnet will load one of the collections, filter through it using their target’s login portal, and let the tools run. With rate limits typically being set at 10-20% success rate, an attacker can achieve high success rates based on attempting tens of millions of times each day.
