2013 breach at Russian cybercrime forum resurfaces with millions of victims' credentials

Have I Been Pwned (HIBP) added the breach on Wednesday, recording 7.2 million unique email addresses. Around 107,000 belonged to forum members, whose exposed data included usernames, IP addresses, and mostly unsalted MD5 password hashes.

Unsalted MD5 is a poor choice for protecting passwords. It's fast to compute, allowing attackers to test guesses at speed, and identical passwords produce identical hashes.

Hardly good hygiene for a hacking forum. You might expect members of a cybercrime forum to know better than to reuse passwords or register with an email address tied to their real identity. Expectations and reality are not always on speaking terms, as AlphaBay founder Alexandre Cazes demonstrated.

Earlier coverage

• N-able releases security hotfixes for zero-day vulnerabilities Nov 11
• 35,578 Grok-built apps exposed online, some leaking data, passwords Nov 11
• Shipping giant Maersk probes 'IT security incident,' data theft Nov 11