OGUsers (2022 breach) ogusers.com OGUsers data breach (2022): what happened and what to do
OGUsers, an account hijacking and SIM swapping forum, was breached in July 2022, its fifth breach since December 2018. About 529,000 email addresses were exposed with usernames, IP addresses and argon2 password hashes.
View all 13,115 breaches- Breach date
- 13 Jul 2022
- Affected
- 529,020
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
OGUsers is a forum where members trade social media handles and discuss account hijacking and SIM swapping. In July 2022 it suffered a data breach, which Have I Been Pwned counts as the fifth since December 2018. HIBP added the data to its database in April 2023.
The forum is a criminal marketplace, so this page just covers what was exposed, so you can check your own email.
What was exposed
HIBP lists 529,020 unique email addresses. The data included:
- Email addresses
- IP addresses
- Usernames
- Passwords, stored as argon2 hashes
Argon2 is a modern, deliberately slow hashing method, much harder to crack than the MD5 hashes in the forum's 2020 breach. Strong, unique passwords are very unlikely to be recovered. Short or common ones still can be.
What it lets criminals do
The main risks are password reuse and exposure of identity. An attacker who cracks a weak hash can try it on other accounts. An IP address together with an email address and username can help link a handle to a real person and approximate location.
If your email appears in more than one OGUsers breach, change any password you used on the forum, and check that none of your other accounts share it.
What to do if you were in it
- 1
Change the password, and every place you reused it
Set a new password on OGUsers, then change it anywhere else you used the same one. Use a password manager so each account gets its own.
- 2
Turn on two-factor login
Two-factor login on your email and other important accounts stops someone who has an old password from getting in with it alone.
- 3
Expect phishing that mentions the breach
Email addresses and usernames can be matched to your other accounts. Don't click links in unexpected emails or texts. Go to the site directly instead.
- 4
Check whether your email or phone is in this and other breaches
A free Serus scan checks your email and phone number against known breaches and tells you which accounts to secure first. Serus monitors breach databases and the dark web and alerts you, but it can't remove data that has already leaked.
Frequently asked
Was I affected by the OGUsers 2022 breach?
If you registered on OGUsers with your email, possibly. HIBP lists 529,020 unique email addresses. Search your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the OGUsers 2022 breach?
Email addresses, IP addresses, usernames and passwords stored as argon2 hashes, according to Have I Been Pwned.
Is this the only OGUsers breach?
No. HIBP describes it as the fifth since December 2018, and lists an earlier one in 2020. Check your email against all of them.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
