PokemonGym.nl Database Allegedly Leaked, 19,600 Player Accounts and Private Messages Published

◱Screenshots

Screenshot 1 Redacted preview Screenshot 2 Redacted preview

⚠Potential impact

The credential exposure here is milder than most gaming leaks. The hashes shown use Argon2id with high memory and iteration parameters, which is current best practice and means bulk password recovery is not realistically achievable; the immediate credential-stuffing risk is correspondingly low. That is worth stating plainly, because it is the part of this dataset that was handled well. The exposure that matters is elsewhere. The account table pairs email address and username with age, gender, country, and two IP addresses, and the dump extends to the platform's private message table including full message text. A fan-made Pokémon RPG draws a user base skewed heavily toward children and teenagers, and the sample conversations are consistent with that. Publishing the private correspondence of that population alongside the identifiers needed to locate and contact them is the central harm here, and it is not one the affected users can remediate: a password can be changed, a past conversation cannot be unpublished. The combination of approximate location from IP, self-reported age and gender, and an active messaging history is precisely the material that supports targeted approaches to minors, which places this well above the usual severity of a small gaming breach. The schema also lists a second credential field alongside the hashed one, whose contents and format are not evident from the post. The claim is unverified.