OVH ovh.com OVH data breach: what happened and what to do
In mid-2015, the vBulletin forum of hosting provider OVH was breached, exposing about 453,000 accounts. Usernames, email addresses, IP addresses and salted MD5 password hashes were included.
View all 13,115 breaches- Breach date
- May 2015
- Affected
- 452,899
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
OVH is a hosting provider. In mid-2015 its user forum, which ran on vBulletin forum software, suffered a data breach. Have I Been Pwned (HIBP) added the data in December 2016, with about 453,000 accounts in it.
This was the forum, not OVH's hosting or customer accounts. HIBP's description covers only the forum, and we have no source saying hosting accounts were involved.
What was exposed
HIBP lists four types of data: email addresses, IP addresses, passwords and usernames. The passwords were stored as salted MD5 hashes. Salting makes each hash unique, but MD5 is old and fast to attack, so short or common passwords can be recovered.
What it lets criminals do
An email address and username tell an attacker you used an OVH forum, which is enough for a believable phishing email about hosting, domains or servers. If you reused the forum password, a cracked hash can be tried against your other accounts. Anyone who runs servers or domains is a more valuable target than the average forum user, so be careful with messages that claim to be from your host.
The breach dates from 2015. The question to ask now is whether the password you used then is still in use.
What to do if you were in it
- 1
Change any password you used on the OVH forum
If you reused it, change it everywhere it appears. Use a unique long password per account.
- 2
Turn on two-factor authentication
Turn it on for your hosting, domain registrar and email accounts first. Those control the most.
- 3
Check messages that claim to be from your host
Don't click links in emails about invoices, expiry or server problems. Sign in through the provider's own site.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches your email address or phone number appears in. Serus monitors breach databases and the dark web and alerts you when your data shows up. It can't remove data from a breach, so the steps here are what protect you.
Frequently asked
Was I affected by the OVH data breach?
If you had an account on the OVH forum in mid-2015, possibly. Search your email on Have I Been Pwned or run a free Serus scan.
What was exposed in the OVH breach?
Usernames, email addresses, IP addresses and passwords stored as salted MD5 hashes, per HIBP.
Were OVH hosting accounts hacked?
HIBP describes a breach of the OVH forum only.
Should I change my password?
Yes, if you reused your forum password anywhere.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
