RaidForums raidforums.com RaidForums data breach: what happened and what to do
In May 2023, data on 478,604 members of the defunct hacking forum RaidForums was posted to another forum. It dated back to September 2020 and included emails, usernames, dates of birth, IP addresses and Argon2 password hashes.
View all 13,177 breaches- Breach date
- 24 Sept 2020
- Affected
- 478,604
- Data exposed
- Dates of birth, Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
RaidForums was a hacking forum that has since been shut down. In May 2023, records on 478,604 of its members were posted on another forum. The data dated back to September 2020. Have I Been Pwned (HIBP) added it that month and lists 478,604 accounts. BleepingComputer reported on the leak when it appeared.
Sources checked: haveibeenpwned.com, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was exposed
HIBP lists dates of birth, email addresses, IP addresses, passwords and usernames. The passwords were stored as Argon2 hashes, a modern scheme designed to be slow to crack.
What it means for you
IP addresses and dates of birth are the sensitive part. An IP address can point to a rough location, and a date of birth is one of the details used to verify identity, so it's worth treating as exposed for good. Email addresses and usernames make phishing easier and can link the account to other accounts you run under the same name.
The forum is gone, so there is no company notice or response to point to. The record of the leak is HIBP's entry and the reporting above.
If you had an account, change any password you reused, turn on two-factor login on accounts that matter, and be wary of messages that mention the forum.
What to do if you were in it
- 1
Change your password everywhere you reused it
Change it on any site first, then on any other account that used the same or a similar password. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or a passkey where the site offers one. The FTC recommends multi-factor authentication for accounts that matter.
- 3
Expect phishing that mentions the breach
Treat unexpected emails about your account with suspicion and don't click their links. The FTC explains how to recognize and avoid phishing.
- 4
Check which other breaches include you
Run a free Serus scan to see which other breaches include your email or phone. Serus monitors breach databases and the dark web and alerts you; it can't remove data from a breach.
- 5
Treat your date of birth as exposed
A date of birth can't be changed. Be careful with identity checks that rely on it alone, and watch for accounts or credit you didn't open at IdentityTheft.gov.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the RaidForums breach?
Search your email on Have I Been Pwned, or run a free Serus scan, which checks breach databases for your email.
What was exposed?
Dates of birth, email addresses, IP addresses, usernames and Argon2 password hashes, according to Have I Been Pwned.
Should I change my password?
Change it anywhere you reused the RaidForums password. Argon2 hashes are hard to crack, but a weak password can still fall.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
