XKCD xkcd.com XKCD forum data breach: what happened and what to do
In July 2019 the forum for the webcomic XKCD was breached. About 562,000 subscribers had usernames, email addresses, IP addresses and phpBB3 MD5 password hashes exposed. Change that password anywhere you reused it.
View all 13,115 breaches- Breach date
- Jul 2019
- Affected
- 561,991
- Data exposed
- Email addresses, IP addresses, Passwords, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
In July 2019, the forum for the webcomic XKCD suffered a data breach affecting 562,000 subscribers. Have I Been Pwned (HIBP) added it on September 1, 2019 and lists it as verified. The data was given to HIBP by security researcher Adam Davies.
What happened
The forum runs on phpBB, a common open-source forum package, and its member database leaked. This affects the forum, not the comic's main site. The forum's own address is forums.xkcd.com.
What was exposed
HIBP counts 561,991 accounts. The data classes are email addresses, IP addresses, passwords and usernames. Passwords were stored in phpBB3's MD5-based format. That format applies repeated rounds of MD5 with a salt, which is better than plain MD5 but still weaker than modern password hashing, so simple passwords can be cracked.
What that lets criminals do
An email and a cracked password are all someone needs for credential stuffing: trying your login on other sites. Your IP address gives a rough location and, together with the username, can link your forum activity to profiles elsewhere. Email alone mostly leads to spam and phishing.
What to do now
If you have a forum account, change its password and any other account where you used the same one. Turn on two-factor login on your email. If you no longer use the forum, ask for the account to be deleted.
What to do if you were in it
- 1
Change your XKCD forum password, and every reuse of it
If you used the same or a similar password anywhere else, change it there too. A password manager makes unique passwords easy.
- 2
Turn on two-factor login
Use an authenticator app or passkey on your email and other important accounts. It stops most takeovers even when an old password is out there.
- 3
Expect phishing that fits the data
Email addresses end up on spam and scam lists. Don't click links in messages that mention an account or a breach; go to the site yourself.
- 4
See which other breaches include you
Run a free Serus scan to see which other breaches include your email or phone.
Frequently asked
Was I affected by the XKCD forum breach?
If you had a forum account in 2019, possibly. Check your email on Have I Been Pwned or run a free Serus scan. HIBP lists 561,991 accounts.
What was exposed in the XKCD forum breach?
Usernames, email addresses, IP addresses and phpBB3 MD5 password hashes.
Does this affect the xkcd.com comics site?
The breach was of the forum database, not of the comic archive.
Should I change my password?
Yes, on the forum and anywhere you reused it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
