Gaming account breach: what happened, and how to recover and lock down your account

Breach / exposure. Updated 2026-09-13. About 5 minutes to read.

Secure the email address linked to your gaming account before anything else, because whoever controls that inbox can reset the game account again.

Gaming accounts are worth stealing. They hold saved payment cards, wallet balances, and in-game items that trade for real money. They are also often protected by an old password that has been reused on other sites. That combination makes them a steady target for criminals, even though large breaches of the gaming companies themselves are relatively rare.

If you think your account has been hacked, or a gaming company has told you about a breach, the order of your response matters. Secure the email account first, clear malware from your computer second, and only then recover and lock down the gaming account through the platform's official support site. This guide covers each step and the scams that follow a breach.

Real gaming breaches and what they exposed

The pattern is clear. Company breaches mostly leak email addresses, usernames and password hashes, and those become fuel for the more common problem: criminals trying the same email and password on every gaming platform.

Zynga, September 2019: the maker of Words With Friends was breached, exposing 173 million unique email addresses with usernames and passwords stored as salted SHA-1 hashes, according to Have I Been Pwned.
Nintendo, April 2020: Nintendo confirmed that about 160,000 Nintendo Accounts were accessed through linked Nintendo Network IDs using passwords leaked elsewhere. Some were used to buy digital content with saved payment methods. Nintendo stopped allowing sign-in with Nintendo Network IDs and urged players to turn on two-step verification.
Epic Games forums, August 2016: about 252,000 forum accounts were exposed, including email addresses, usernames and salted MD5 password hashes. Old forum accounts like these are often forgotten while the password lives on elsewhere.
Discord, October 2025: Discord said attackers compromised a third-party customer service provider, exposing names, usernames, emails, IP addresses, support messages and the last four digits of some payment cards, plus about 70,000 government ID photos submitted for age checks. Discord said passwords were not involved.

How gaming accounts are usually taken over

Credential stuffing: a password leaked from one site is tried automatically on Steam, PlayStation, Xbox, Epic, Battle.net and others.
Fake login pages: links to free skins, giveaways, tournament sign-ups or vote for my team pages that copy a real sign-in screen.
Report scams: someone claims your account was reported by mistake and sends you to a fake support agent on Discord. Valve states any claim that you have been accidentally or falsely reported is always a scam.
Malware: fake cheats, mod managers, cracked games and voice chat apps that steal saved passwords and login sessions. A stolen session can let an attacker in without your password or two-factor code.
Email takeover: if your email is compromised, the attacker simply resets the gaming account password.

Check whether you were affected

Run the email address linked to each gaming account through the free email breach check, and note any breach that included passwords.
Test the password you use for gaming with the password checker. If it appears in breach data or is used anywhere else, treat it as compromised.
Sign in to each platform directly, not through a link, and review signed-in devices, recent sign-in locations, purchase history and trade or gift history.
Search your email for password reset, new sign-in and email change notices you did not request.
Check your bank or card statement for game store charges you do not recognise.

If your gaming account was hacked: recover it in this order

Secure your email account from a device you trust: change the password, turn on two-factor authentication, sign out all other sessions and delete any forwarding rules you did not create.
Scan your computer for malware before you change the game password. Otherwise the new password can be stolen too. Remove any cheat tools, cracked software or unofficial launchers.
Use the platform's official recovery process, typed directly into your browser: help.steampowered.com for Steam, or the account help pages of PlayStation, Xbox, Nintendo, Epic Games, Riot or Battle.net. Valve notes that you can recover a Steam account through support even if the attacker changed the email, password and phone number.
Have proof of ownership ready, such as the card type, name and last four digits used for purchases, a receipt, or a product key you redeemed.
After recovery, change the password to a unique one, turn on the platform's authenticator, review linked third-party apps and remove saved payment methods you do not need.
Call your card issuer about unauthorised purchases and ask for a replacement card if the full card details may have been exposed.
Warn friends. Hijacked accounts are used to send scam links to everyone on the friends list.

Never pay someone who offers to recover your account, and never pay an attacker who is holding it. Official support is free, and game company staff will not contact you through Discord or in-game chat to fix an account problem.

Lock down every gaming account

Use a different password for each platform, created with a password generator or password manager.
Turn on app-based two-factor authentication where offered, such as the Steam Guard Mobile Authenticator. Text message codes are better than nothing but weaker.
Give gaming accounts their own email alias, so a leak from a game forum does not expose your main inbox.
Store less payment data. Use wallet top-ups or gift cards instead of a saved card where practical.
For children's accounts, use the platform's family or parental settings to require approval for purchases.
Only download mods, cheats and tools you trust from official sources, and never enter your password on a site reached through a chat link.

Frequently asked questions

My gaming company emailed me about a breach. Is the email real?

It may be, but breach notices are copied by scammers. Do not click links in the email. Go to the company's website or app directly, look for the official announcement, and change your password there.

Can a hacker get into my account if I have two-factor authentication?

It is much harder, but still possible if malware steals a logged-in session from your computer or you type a code into a fake site. Keep your device clean and only enter codes on the platform's real website or app.

Will I get my stolen items or skins back?

Often not. Valve, for example, states that Steam Support does not restore items that have left an account for any reason. Other platforms have their own policies, so ask when you open a support ticket, but plan on prevention rather than restoration.

Someone says my account was reported by mistake and I need to contact support on Discord. What do I do?

Ignore them and block the account. This is a well-known scam. Real support for Steam is only on help.steampowered.com, and other platforms likewise handle account problems through their own help sites.