OGUsers (2019 breach) ogusers.com OGUsers data breach 2019: what happened and what to do
In May 2019, a database backup from the account-hijacking forum OGUsers was published, exposing 161,143 email addresses plus usernames, IP addresses, private messages and passwords stored as salted MD5 hashes.
View all 13,115 breaches- Breach date
- 26 Dec 2018
- Affected
- 161,143
- Data exposed
- Email addresses, IP addresses, Passwords, Private messages, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
OGUsers is a forum where people trade hijacked online accounts and discuss SIM swapping. In May 2019 its database was stolen. According to Have I Been Pwned, the exposed file was a backup from December 2018, and it was published on a rival hacking forum. Krebs on Security reported the leak after the forum's operator blamed an outage on a hard drive failure.
The data held 161,143 unique email addresses, spread across about 113,000 forum users and other tables in the database.
What was exposed
Email addresses, usernames, IP addresses, private messages and passwords stored as salted MD5 hashes. MD5 is a weak hashing method, so passwords that were simple can be cracked.
What it means for you
Most people in this breach signed up on purpose, so the practical risks are specific. Anyone who reused the OGUsers password elsewhere has an exposed password to worry about. Private messages and IP addresses could link a username to a real person. If you used an email address on the forum, expect extra phishing and targeting.
The breach can't be reversed. Serus monitors breach databases and the dark web for your email and alerts you when it appears in a new leak, so you know when to act.
What to do if you were in it
- 1
Change reused passwords
If you used your OGUsers password anywhere else, change it on every one of those accounts. Use a unique password for each, from a password manager.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your email and phone account first. Avoid SMS codes where you can.
- 3
Protect your phone number from SIM swaps
Ask your carrier to add a port-out PIN or number lock to your account.
- 4
Expect targeted phishing
Messages that mention the forum or a username you used there are likely scams or extortion. Don't reply or pay.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see every breach that includes you.
Frequently asked
Was I in the OGUsers breach?
Look up your email on Have I Been Pwned, which lists 161,143 email addresses for this breach, or run a free Serus scan.
What was exposed?
Email addresses, usernames, IP addresses, private messages and passwords stored as salted MD5 hashes.
Should I change my password?
Yes, on any site where you reused the OGUsers password. MD5 hashes are easier to crack than modern ones.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
