A new study published in IEEE ICCA 2025, has found that more than 60 percent of cybersecurity breaches in online gaming are caused not by sophisticated hacking, but by the everyday choices of humans themselves, making human behaviour the single greatest vulnerability in a global industry projected to generate $455 billion.
The research, conducted by a team of academics and students from Cyber Security and Behaviour program at Western Sydney University examined 80 academic and industry sources spanning 2011 to 2024 to build what they describe as a “holistic behavioural risk profile” of online gamers.
The findings are striking password reuse, susceptibility to phishing scams, and downloading unofficial cheat software are among the most common behaviours putting millions of players at risk and no technical patch can fully fix them.
When the player is the problem
The paper highlights that gaming environments are uniquely vulnerable because of the high levels of social interaction and emotional investment involved. Players who are eager to gain a competitive edge or acquire rare in-game items are far more likely to click malicious links or download unverified software; decisions that bypass even the most advanced security systems.
The research states that “human factors consistently outweigh technical factors in explaining cybersecurity incidents” noting that security tools like multi-factor authentication and AI detection systems are frequently rendered ineffective when users engage in risky behaviour.
A key concept explored is “security fatigue” the psychological exhaustion that sets in when players are repeatedly prompted with security requirements. Rather than complying, fatigued users begin creating weaker passwords, reusing old ones, or ignoring warnings altogether.
Real-world breaches that shook the gaming world
The study draws on several landmark incidents to illustrate how human behaviour amplifies technical failures. The 2011 PlayStation Network breach, which affected more than 77 million users, was worsened by widespread password reuse across accounts. A 2016 CD Projekt Red forum hack exposed 1.9 million users through outdated systems combined with poor user practices.
Credential stuffing; where attackers use stolen username-password combinations from other breaches, accounted for 45 percent of attacks analysed, with phishing responsible for a further 30 percent.
A framework for a safer gaming future
Rather than simply identifying the problem, the team proposes a Collaborative Human-Centric Defense Framework; a dual approach that places responsibility on both developers and players.
For developers, the researchers recommend embedding security into the earliest stages of game design; a principle known as “secure-by-design”. Alongside gamified security education, such as awarding in-game achievements for enabling multi-factor authentication.
For players, the advice is practical: use a password manager, enable multi-factor authentication, avoid unofficial cheat tools and mods, and be cautious of unsolicited messages from online contacts no matter how trustworthy they may seem.
The paper concludes that “technology alone cannot compensate for human vulnerability” and calls for future gaming platforms to treat player behaviour not as an afterthought, but as a core component of security architecture.
The paper, co-authored by Syed Shuaib Warisi et al, is published in IEEE Xplore and is available:https://ieeexplore.ieee.org/abstract/document/11430803
Comments