Malwarebytes malwarebytes.org Malwarebytes forum data breach: what happened and what to do
In November 2014, the Malwarebytes forum was hacked and about 112,000 member records were exposed: email and IP addresses, birth dates, usernames and weakly salted password hashes that many attackers could crack.
View all 13,115 breaches- Breach date
- 15 Nov 2014
- Affected
- 111,623
- Data exposed
- Dates of birth, Email addresses, IP addresses, Passwords, Usernames, Website activity
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In November 2014, the Malwarebytes support forum was hacked. Have I Been Pwned lists 111,623 member records from the breach, and it was added to the service in March 2016. The forum ran on IP.Board, a common forum platform.
The breach hit the forum only. It wasn't a breach of Malwarebytes' security software or of the accounts people use to buy or manage the product.
What was exposed
The records contained email addresses and passwords, plus usernames and IP addresses. Birth dates were in there too, and Have I Been Pwned also lists website activity. The passwords were stored as salted hashes, but the implementation was weak, which let attackers crack many of them quickly. If your forum password was a common word or a short phrase, assume it was recovered.
What that means for you
A cracked password is only a problem if you still use it somewhere. Attackers try leaked email and password pairs on other sites, a tactic called credential stuffing. If you used the same password on the forum and on your email, someone could have reached your inbox and from there reset other accounts.
Email addresses and birth dates are also useful for phishing. A message that knows your birth date or that you used a security forum looks more trustworthy than a generic one.
What to do now
The breach is more than a decade old, so most people have changed passwords since. It's still worth checking that no account you care about uses a password from that period. Start with email and banking. Use a different password on each site, always.
What to do if you were in it
- 1
Change the password and anywhere you reused it
Set a new password on the affected account. Then change it on any other site where you used the same one, starting with email and banking. A password manager makes unique passwords painless.
- 2
Turn on two-factor login
Use an authenticator app or a security key on your email, bank and shopping accounts. A stolen password alone then isn't enough to get in.
- 3
Expect phishing that mentions the breach
Criminals use your email address and birth date to write messages that look personal. Don't click links in unexpected emails or texts about your account. Go to the site directly instead.
- 4
Check whether your email or phone is in this and other breaches
Run a free scan with Serus to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you if your data shows up again.
Frequently asked
Was I affected by the Malwarebytes forum breach?
Only if you had an account on the Malwarebytes forum in 2014. You can search your email address on Have I Been Pwned to see if it appears in this breach.
What was exposed?
Email addresses and usernames, IP addresses, dates of birth, website activity and passwords stored as weak salted hashes.
Were Malwarebytes products or payment details affected?
Have I Been Pwned lists forum member records only. Payment details aren't among the exposed data types.
Should I change my password?
Yes, if you ever reused your forum password anywhere. Change it on those sites and use a unique one for each account.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
