DaniWeb daniweb.com DaniWeb data breach: what happened and what to do
In late 2015, the technology forum DaniWeb was breached, exposing about 1.1 million accounts: email addresses, IP addresses and salted MD5 password hashes. DaniWeb says the leaked hashes and salts were incorrect. Change any password you reused.
View all 13,115 breaches- Breach date
- Dec 2015
- Affected
- 1,131,636
- Data exposed
- Email addresses, IP addresses, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In late 2015, the technology and social site DaniWeb suffered a data breach. About 1.1 million accounts were exposed. Have I Been Pwned added the data to its index on 28 December 2016.
What was exposed
The data included email addresses, IP addresses and salted MD5 hashes of passwords. A hash is a scrambled version of a password, and MD5 is an old, fast scheme that is easy to attack when a password is simple. DaniWeb has said the breached password hashes and salts are incorrect, and that it has since moved to new infrastructure and software.
What it lets criminals do
An email address on a technology forum tells a scammer you probably have an account on similar sites, which makes a fake "your account was locked" message more believable. IP addresses give a rough location. If you reused your DaniWeb password elsewhere, that is the real risk, because attackers try leaked email and password pairs on other services.
The company's response
DaniWeb's statement, as relayed by Have I Been Pwned, is that the password data in the leak does not match what it stored, and that it replaced its infrastructure and software afterward.
What to do if you were in it
- 1
Change your password here and anywhere you reused it
Set a new password on DaniWeb if you still have an account. Then change it on any other account that used the same or a similar password. A password manager makes unique ones easy.
- 2
Turn on two-factor login
Use an authenticator app or a hardware key on your email, banking and shopping accounts first, since those are what an attacker targets.
- 3
Expect phishing that mentions forums or tech accounts
Treat unexpected emails about account problems with suspicion. Go to the site directly instead of clicking the link.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email or phone, and get alerts if new ones appear.
Frequently asked
Was I affected by the DaniWeb breach?
Have I Been Pwned lets you search your email address. Serus's free scan also checks breach databases for your email and phone.
What was exposed in the DaniWeb breach?
Email addresses, IP addresses and salted MD5 password hashes, about 1.1 million accounts in total.
Should I change my password?
If you used your DaniWeb password anywhere else, yes. Change it on every site that shares it, and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
