SirHurt sirhurt.net SirHurt data breach: what happened and what to do
In April 2021, the Roblox cheats site SirHurt was breached, exposing 90,655 customer records: email addresses, IP addresses, usernames and passwords stored as MD5 hashes. Have I Been Pwned added it in May 2022.
View all 13,177 breaches- Breach date
- 23 Apr 2021
- Affected
- 90,655
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
SirHurt is a website that sold cheats for Roblox. In April 2021 it suffered a data breach, and Have I Been Pwned (HIBP) added the data on 24 May 2022. HIBP counts 90,655 accounts and describes them as customer records.
What was exposed
The data included email addresses, IP addresses, usernames and passwords. HIBP says the passwords were stored as MD5 hashes. MD5 is a fast, outdated way to store passwords, which means weak ones can be cracked quickly.
Why it matters
A password from a small site often matches the one a person uses elsewhere. If that's you, the leaked pair of email and password can be tried on your email, gaming and shopping accounts. The email address also puts you on lists for phishing, and a scam message that mentions Roblox or game cheats will look more believable to someone who bought them.
Company response
HIBP links to a forum thread about the incident but not to a statement from SirHurt, so the facts above come from HIBP's verified entry.
Check your own exposure
Search your email address on HIBP, or run a free Serus scan to see every breach it appears in.
Sources checked: haveibeenpwned.com, consumer.ftc.gov
Last verified against the official page:
What to do if you were in it
- 1
Change the password anywhere you reused it
The passwords were stored as MD5 hashes, and hashes like that can be cracked. If your SirHurt password is also your password somewhere else, change it on those sites now. Use a different password on every account, ideally from a password manager.
- 2
Turn on two-factor login
Two-factor authentication means a stolen password alone doesn't get anyone into your email, bank or shopping accounts. Start with your email, since it resets everything else.
- 3
Expect phishing that mentions the breach
Your email address was exposed, so scammers can write to you as if they know you. Don't click links in unexpected messages. Go to the site yourself instead.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches your email address or phone number appears in. Serus monitors breach databases and the dark web and alerts you when something new turns up. It can't remove data that has already leaked, so the steps above are still the fix.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the SirHurt breach?
If you had a SirHurt account in April 2021, likely yes. Have I Been Pwned lists 90,655 accounts and lets you search your email address.
What was exposed in the SirHurt breach?
Email addresses, IP addresses, usernames and passwords stored as MD5 hashes.
Should I change my password?
Yes, anywhere you reused your SirHurt password. Use a unique password per site and turn on two-factor login, as the FTC advises after a breach.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
