Dragonica Lunaris Breach Exposes 126K Player Accounts

Have I Been Pwned reports that the European Dragonica private server, Dragonica Lunaris, suffered a data breach in December 2025. This incident exposed 126,293 unique accounts, a significant number for a private gaming server. The compromised data includes email addresses, usernames, dates of birth, and bcrypt password hashes.

The service operator has confirmed the breach and indicated that the underlying vulnerability has since been remediated. While bcrypt provides a stronger hashing mechanism than older algorithms, attackers with sufficient resources can still attempt to crack these hashes, especially for users with weak or reused passwords. The exposure of email addresses and usernames creates a clear avenue for credential stuffing and phishing attacks targeting other services.

This isn’t just about a game. Attackers know gamers often reuse passwords across platforms. This breach provides a fresh list of credentials and personal data that will be tested against banking, social media, and other high-value accounts. Defenders need to assume these credentials are now weaponized.