Official Breach Notices
Not the claims of gangs: data breaches disclosed by organisations, regulators and verified records.
Crack Community
In late 2013, the Crack Community forum specialising in cracks for games was compromised and over 19k accounts published online. Built on the MyBB forum platform, the compromised data included email addresses, IP addresses and salted MD5 passwords.
Lizard Squad
In January 2015, the hacker collective known as "Lizard Squad" created a DDoS service by the name of "Lizard Stresser" which could be procured to mount attacks against online targets. Shortly thereafter, the service suffered a data breach which resulted in the public disclosure of over 13k user accounts including passwords stored in plain text.
Domino's
In June 2014, Domino's Pizza in France and Belgium was hacked by a group going by the name "Rex Mundi" and their customer data held to ransom. Domino's refused to pay the ransom and six months later, the attackers released the data along with troves of other hacked accounts. Amongst the customer data was passwords stored with a weak MD5 hashing algorithm and no salt.
AhaShare.com
In May 2013, the torrent site AhaShare.com suffered a breach which resulted in more than 180k user accounts being published publicly. The breach included a raft of personal information on registered users plus despite assertions of not distributing personally identifiable information, the site also leaked the IP addresses used by the registered identities.
Yandex Dump
In September 2014, news broke of a massive leak of accounts from Yandex , the Russian search engine giants who also provides email services. The purported million "breached" accounts were disclosed at the same time as nearly 5M mail.ru accounts with both companies claiming the credentials were acquired via phishing scams rather than being obtained as a result of direct attacks against their services.
Bitcoin Security Forum Gmail Dump
In September 2014, a large dump of nearly 5M usernames and passwords was posted to a Russian Bitcoin forum . Whilst commonly reported as 5M "Gmail passwords", the dump also contained 123k yandex.ru addresses. Whilst the origin of the breach remains unclear, the breached credentials were confirmed by multiple source as correct , albeit a number of years old.
Pokémon Creed
In August 2014, the Pokémon RPG website Pokémon Creed was hacked after a dispute with rival site, Pokémon Dusk . In a post on Facebook , "Cruz Dusk" announced the hack then pasted the dumped MySQL database on pkmndusk.in . The breached data included over 116k usernames, email addresses and plain text passwords.
Insanelyi
In July 2014, the iOS forum Insanelyi was hacked by an attacker known as Kim Jong-Cracks . A popular source of information for users of jailbroken iOS devices running Cydia, the Insanelyi breach disclosed over 104k users' emails addresses, user names and weakly hashed passwords (salted MD5).
Lounge Board
At some point in 2013, 45k accounts were breached from the Lounge Board "General Discussion Forum" and then dumped publicly . Lounge Board was a MyBB forum launched in 2012 and discontinued in mid 2013 (the last activity in the logs was from August 2013).
Verified
In January 2014, one of the largest communities of Eastern Europe cybercriminals known as "Verified" was hacked . The breach exposed nearly 17k users of the vBulletin forum including their personal messages and other potentially personally identifiable information.
Astropid
In December 2013, the vBulletin forum for the social engineering site known as "AstroPID" was breached and leaked publicly . The site provided tips on fraudulently obtaining goods and services, often by providing a legitimate "PID" or Product Information Description. The breach resulted in nearly 6k user accounts and over 220k private messages between forum members being exposed.
Manga Traders
In June 2014, the Manga trading website Mangatraders.com had the usernames and passwords of over 900k users leaked on the internet (approximately 855k of the emails were unique). The passwords were weakly hashed with a single iteration of MD5 leaving them vulnerable to being easily cracked.
Win7Vista Forum
In September 2013, the Win7Vista Windows forum (since renamed to the "Beyond Windows 9" forum) was hacked and later had its internal database dumped . The dump included over 200k members’ personal information and other internal data extracted from the forum.
Cannabis.com
In February 2014, the vBulletin forum for the Marijuana site cannabis.com was breached and leaked publicly . Whilst there has been no public attribution of the breach, the leaked data included over 227k accounts and nearly 10k private messages between users of the forum.
hackforums.net
In June 2011, the hacktivist group known as "LulzSec" leaked one final large data breach they titled "50 days of lulz" . The compromised data came from sources such as AT&T, Battlefield Heroes and the hackforums.net website . The leaked Hack Forums data included credentials and personal information of nearly 200,000 registered forum users.
Business Acumen Magazine
In April 2014, the Australian "Business Acumen Magazine" website was hacked by an attacker known as 1337MiR . The breach resulted in over 26,000 accounts being exposed including usernames, email addresses and password stored with a weak cryptographic hashing algorithm (MD5 with no salt).
Fridae
In May 2014, over 25,000 user accounts were breached from the Asian lesbian, gay, bisexual and transgender website known as "Fridae". The attack which was announced on Twitter appears to have been orchestrated by Deletesec who claim that "Digital weapons shall annihilate all secrecy within governments and corporations". The exposed data included password stored in plain text.
BigMoneyJobs
In April 2014, the job site bigmoneyjobs.com was hacked by an attacker known as "ProbablyOnion" . The attack resulted in the exposure of over 36,000 user accounts including email addresses, usernames and passwords which were stored in plain text. The attack was allegedly mounted by exploiting a SQL injection vulnerability.
Boxee
In March 2014, the home theatre PC software maker Boxee had their forums compromised in an attack. The attackers obtained the entire vBulletin MySQL database and promptly posted it for download on the Boxee forum itself. The data included 160k users, password histories, private messages and a variety of other data exposed across nearly 200 publicly exposed tables.
hemmelig.com
In December 2011, Norway's largest online sex shop hemmelig.com was hacked by a collective calling themselves "Team Appunity" . The attack exposed over 28,000 usernames and email addresses along with nicknames, gender, year of birth and unsalted MD5 password hashes.
1.196 notices · page 59 / 60
Follow breach notices through the API
With a free API key you can take the same data into your dashboard, your scripts or your own application.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/breaches?source=kvkk"