Outdated vBulletin Forum Leads to 93K Account Breach at Serbian Tech Site Benchmark
What Happened – In November 2019 the public forum of the Serbian technology news portal Benchmark was compromised. Attackers accessed the underlying vBulletin database and extracted 93,343 records containing email addresses, IP addresses, usernames and passwords (stored as salted MD5 hashes). The breach was traced to the forum running an unsupported, outdated vBulletin version.
Why It Matters for Trust & Control Assurance
- The incident exemplifies a classic configuration‑management failure: unpatched software created a foothold for data exfiltration.
- Continuous control‑assurance programs require documented evidence that all web‑applications are inventoried, supported, and patched on schedule.
- Demonstrating timely patch management and secure credential storage satisfies a single control objective that maps to many frameworks (e.g., NIST CSF 2.0, ISO 27001, SOC 2).
Who Is Affected – Online publishing and media platforms that rely on third‑party CMS/forum software.
Recommended Actions
- Conduct an inventory of all public‑facing applications and verify they run supported versions.
- Implement an automated patch‑management process with audit‑ready logs.
- Replace weak hashing (MD5) with modern algorithms (e.g., bcrypt, Argon2).
Source: Have I Been Pwned – Benchmark breach
Technical Notes
- Attack vector: exploitation of a known vulnerability in an outdated vBulletin release (misconfiguration/unsupported software).
- Exposed data types: email, IP, username, password hashes (salted MD5).
Source: HIBP breach details