Official Breach Notices
Not the claims of gangs: data breaches disclosed by organisations, regulators and verified records.
Lounge Board
At some point in 2013, 45k accounts were breached from the Lounge Board "General Discussion Forum" and then dumped publicly . Lounge Board was a MyBB forum launched in 2012 and discontinued in mid 2013 (the last activity in the logs was from August 2013).
Verified
In January 2014, one of the largest communities of Eastern Europe cybercriminals known as "Verified" was hacked . The breach exposed nearly 17k users of the vBulletin forum including their personal messages and other potentially personally identifiable information.
Astropid
In December 2013, the vBulletin forum for the social engineering site known as "AstroPID" was breached and leaked publicly . The site provided tips on fraudulently obtaining goods and services, often by providing a legitimate "PID" or Product Information Description. The breach resulted in nearly 6k user accounts and over 220k private messages between forum members being exposed.
Manga Traders
In June 2014, the Manga trading website Mangatraders.com had the usernames and passwords of over 900k users leaked on the internet (approximately 855k of the emails were unique). The passwords were weakly hashed with a single iteration of MD5 leaving them vulnerable to being easily cracked.
Win7Vista Forum
In September 2013, the Win7Vista Windows forum (since renamed to the "Beyond Windows 9" forum) was hacked and later had its internal database dumped . The dump included over 200k members’ personal information and other internal data extracted from the forum.
Cannabis.com
In February 2014, the vBulletin forum for the Marijuana site cannabis.com was breached and leaked publicly . Whilst there has been no public attribution of the breach, the leaked data included over 227k accounts and nearly 10k private messages between users of the forum.
hackforums.net
In June 2011, the hacktivist group known as "LulzSec" leaked one final large data breach they titled "50 days of lulz" . The compromised data came from sources such as AT&T, Battlefield Heroes and the hackforums.net website . The leaked Hack Forums data included credentials and personal information of nearly 200,000 registered forum users.
Business Acumen Magazine
In April 2014, the Australian "Business Acumen Magazine" website was hacked by an attacker known as 1337MiR . The breach resulted in over 26,000 accounts being exposed including usernames, email addresses and password stored with a weak cryptographic hashing algorithm (MD5 with no salt).
Fridae
In May 2014, over 25,000 user accounts were breached from the Asian lesbian, gay, bisexual and transgender website known as "Fridae". The attack which was announced on Twitter appears to have been orchestrated by Deletesec who claim that "Digital weapons shall annihilate all secrecy within governments and corporations". The exposed data included password stored in plain text.
BigMoneyJobs
In April 2014, the job site bigmoneyjobs.com was hacked by an attacker known as "ProbablyOnion" . The attack resulted in the exposure of over 36,000 user accounts including email addresses, usernames and passwords which were stored in plain text. The attack was allegedly mounted by exploiting a SQL injection vulnerability.
Boxee
In March 2014, the home theatre PC software maker Boxee had their forums compromised in an attack. The attackers obtained the entire vBulletin MySQL database and promptly posted it for download on the Boxee forum itself. The data included 160k users, password histories, private messages and a variety of other data exposed across nearly 200 publicly exposed tables.
hemmelig.com
In December 2011, Norway's largest online sex shop hemmelig.com was hacked by a collective calling themselves "Team Appunity" . The attack exposed over 28,000 usernames and email addresses along with nicknames, gender, year of birth and unsalted MD5 password hashes.
UN Internet Governance Forum
In February 2014, the Internet Governance Forum (formed by the United Nations for policy dialogue on issues of internet governance) was attacked by hacker collective known as Deletesec . Although tasked with "ensuring the security and stability of the Internet", the IGF’s website was still breached and resulted in the leak of 3,200 email addresses, names, usernames and cryptographically stored passwords.
Muslim Directory
In February 2014, the UK guide to services and business known as the Muslim Directory was attacked by the hacker known as @th3inf1d3l . The data was consequently dumped publicly and included the web accounts of tens of thousands of users which contained data including their names, home address, age group, email, website activity and password in plain text.
Spirol
In February 2014, Connecticut based Spirol Fastening Solutions suffered a data breach that exposed over 70,000 customer records . The attack was allegedly mounted by exploiting a SQL injection vulnerability which yielded data from Spirol’s CRM system ranging from customers’ names, companies, contact information and over 55,000 unique email addresses.
Forbes
In February 2014, the Forbes website succumbed to an attack that leaked over 1 million user accounts . The attack was attributed to the Syrian Electronic Army, allegedly as retribution for a perceived "Hate of Syria". The attack not only leaked user credentials, but also resulted in the posting of fake news stories to forbes.com.
Tesco
In February 2014, over 2,000 Tesco accounts with usernames, passwords and loyalty card balances appeared on Pastebin . Whilst the source of the breach is not clear, many confirmed the credentials were valid for Tesco and indeed they have a history of poor online security .
Bell (2014 breach)
In February 2014, Bell Canada suffered a data breach via the hacker collective known as NullCrew . The breach included data from multiple locations within Bell and exposed email addresses, usernames, user preferences and a number of unencrypted passwords and credit card data from 40,000 records containing just over 20,000 unique email addresses and usernames.
WPT Amateur Poker League
In January 2014, the World Poker Tour (WPT) Amateur Poker League website was hacked by the Twitter user @smitt3nz. The attack resulted in the public disclosure of 175,000 accounts including 148,000 email addresses. The plain text password for each account was also included in the breach.
Battlefield Heroes
In June 2011 as part of a final breached data dump, the hacker collective "LulzSec" obtained and released over half a million usernames and passwords from the game Battlefield Heroes . The passwords were stored as MD5 hashes with no salt and many were easily converted back to their plain text versions.
988 notices · page 49 / 50
Follow breach notices through the API
With a free API key you can take the same data into your dashboard, your scripts or your own application.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/breaches?source=kvkk"