Forbes forbes.com Forbes data breach: what happened and what to do
In February 2014, the Syrian Electronic Army hacked Forbes and leaked about 1.06 million user accounts. The data was usernames, email addresses, passwords and website URLs.
View all 13,115 breaches- Breach date
- 15 Feb 2014
- Affected
- 1,057,819
- Data exposed
- Email addresses, Passwords, User website URLs, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In February 2014, the Forbes website was attacked and over 1 million user accounts were leaked. The Syrian Electronic Army claimed the attack, and Have I Been Pwned (HIBP) says it was allegedly in retaliation for a perceived "Hate of Syria". The attackers also posted fake news stories to forbes.com.
HIBP counts 1,057,819 accounts. The data covers email addresses, usernames, passwords and user website URLs. Forbes said at the time that the passwords were encrypted, and security press noted that the protection was weak enough for many to be cracked.
What does that give a criminal? An email address and a cracked password is a working key for anyone who reused them. Credential stuffing tools try the pair on email, retail and banking sites automatically, so one forgotten Forbes login can open something far more valuable. Email addresses on their own feed phishing, and the website URL field sometimes points at a personal or business site.
Forbes told readers to change their passwords once sign-in returned. If you registered on the site before 2014 and never changed that password on other accounts, that advice still applies.
No settlement has been reported. The breach is old, but leaked credentials don't expire, and they keep circulating in lists that attackers reuse.
What to do if you were in it
- 1
Change the password everywhere you reused it
Search your password manager for the Forbes password. Change every account that shares it, starting with email, then banking and shopping. Make each one unique.
- 2
Turn on two-factor authentication
Use an authenticator app or security key on your email and financial accounts, so a leaked password alone isn't enough.
- 3
Expect phishing to your email
Your address was exposed, so treat messages that mention Forbes, subscriptions or account problems with suspicion. Don't click links; go to the site directly.
- 4
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web for your email, phone number and passwords, and alerts you when they show up. You can run a free scan at serus.ai. Serus can't remove data from a breach, but it tells you what to change.
Frequently asked
Was I affected by the Forbes breach?
If you had a Forbes account in early 2014, possibly. Have I Been Pwned lets you search your email address, and a free Serus scan checks it against this and other breaches.
What was exposed?
Have I Been Pwned lists email addresses, passwords, user website URLs and usernames.
Should I change my password?
Yes, if you reused your Forbes password anywhere. Change those accounts and use unique passwords from now on.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
