OGUsers (2021 breach) ogusers.com OGUsers data breach 2021: what happened and what to do
In April 2021, the account hijacking and SIM swapping forum OGUsers was breached. About 348,000 unique email addresses leaked, along with usernames, IP addresses and hashed passwords. If you had an account, change any reused password.
View all 13,115 breaches- Breach date
- 11 Apr 2021
- Affected
- 348,302
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
OGUsers is a forum where people trade and hijack online accounts and discuss SIM swapping. In April 2021 it was breached again. According to Have I Been Pwned, it was the fourth breach of the site since December 2018. The data was later offered for sale on a rival hacking forum.
BleepingComputer's reporting says an administrator confirmed the attack and that the intruders got in through the forum's software. Earlier OGUsers breaches, in 2019 and 2020, were separate incidents.
What was exposed
The leaked data held usernames, email addresses, IP addresses and passwords. The passwords were stored as salted MD5 or argon2 hashes, which are scrambled versions of the real password. Weaker hashes like MD5 can often be cracked, especially when the original password was short or common. Have I Been Pwned counted about 348,000 unique email addresses.
Why it matters to you
The people in this breach are mostly forum members, but not only: some accounts may have been made with an email address that belongs to someone else, or one reused from elsewhere. If your email is in the data, the main risks are a cracked password being tried on your other accounts, and more phishing aimed at that address. An IP address can also hint at roughly where you connect from.
The forum is a criminal marketplace, so there is no company notice and no free monitoring offer.
Check your own exposure
Look up your email on Have I Been Pwned, or run a free Serus scan to see this and other breaches that include your email or phone.
What to do if you were in it
- 1
Change the password and any reuse of it
If you ever used the same or a similar password on OGUsers and anywhere else, change it on every one of those accounts. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your email, bank and phone carrier accounts first. It blocks most takeovers even when a password is already out.
- 3
Lock down your phone number against SIM swaps
Ask your carrier to add a port-out PIN or number lock. A SIM swap lets someone receive your texts, including login codes.
- 4
Expect phishing to this email address
Don't click links in messages that mention an account or a breach. Go to the site yourself.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email or phone.
Frequently asked
Was I affected by the OGUsers 2021 breach?
Have I Been Pwned lists about 348,000 unique email addresses from it. Enter your email there, or run a free Serus scan, to see whether yours is included.
What was exposed in the OGUsers breach?
Usernames, email addresses, IP addresses and passwords stored as salted MD5 or argon2 hashes.
Should I change my password?
Yes, if you used the same password anywhere else. Hashed passwords can sometimes be cracked, so treat any reused password as exposed.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
