Bot of Legends Forum Breach Exposes 238,373 User Accounts
What Happened – In November 2014 the public forum Bot of Legends (running IP.Board) was compromised, leaking 238,373 records that included usernames, email addresses, IP addresses and passwords stored as salted MD5 hashes.
Why It Matters for Trust & Control Assurance
- The incident illustrates a classic credential‑protection failure that a continuous control‑assurance program should detect and evidence (e.g., strong password hashing, regular credential‑risk reviews).
- Demonstrates the need for auditable identity‑and‑access controls that can be mapped to a single control objective and thereby satisfy multiple frameworks (e.g., NIST CSF 2.0 PR.AC‑01).
- Highlights the value of a platform that provides real‑time evidence of password‑policy enforcement and hashing‑algorithm upgrades.
Who Is Affected – Online community platforms, SaaS forum providers, and any organization that stores user credentials in legacy formats.
Recommended Actions
- Review and upgrade password‑storage mechanisms to modern, computationally‑hard hashing (e.g., Argon2, bcrypt).
- Conduct a credential‑risk assessment and map findings to the “protect credentials” control objective.
- Collect and retain evidence of hashing‑algorithm changes for audit readiness.
Technical Notes – The breach stemmed from inadequate password hashing (salted MD5) and likely a web‑application vulnerability in the IP.Board installation. No specific CVE is cited, but the weakness is well‑known. Source: [Have I Been Pwned – Bot of Legends breach]