Cannabis.com Forum Breach Exposes 227,746 User Records
What Happened – In February 2014 the vBulletin forum powering cannabis.com was compromised. Attackers extracted more than 227 k user accounts, including private messages, passwords, dates of birth, email addresses, IPs and other personal identifiers, and the data was later posted publicly.
Why It Matters for Trust & Control Assurance
- Unpatched forum software created a vulnerability gap that a continuous control‑assurance program is designed to surface and remediate before exploitation.
- Demonstrating timely patch management and evidence of remediation satisfies a core control objective that maps to many frameworks (e.g., NIST CSF 2.0 Identify‑Protect).
- Having auditable logs of vulnerability scans and remediation actions provides the defensible evidence needed for regulators and partners.
Who Is Affected – Online retail/e‑commerce platforms, community forums, and any organization that runs legacy web applications handling personal data.
Recommended Actions
- Inventory all legacy web applications and verify they are running supported, patched versions.
- Implement continuous vulnerability scanning and automated patch deployment for web‑facing software.
- Capture and retain remediation evidence (scan reports, ticketing records) to support audit readiness. Source: https://haveibeenpwned.com/api/v3/breach/CannabisForum
Technical Notes
- The breach is attributed to a known vBulletin vulnerability that was publicly disclosed years earlier; no specific CVE is cited in the public report.
- Exfiltrated data includes dates of birth, email addresses, geographic locations, historical passwords, instant‑messenger IDs, IP addresses, private messages, usernames and site activity logs. Source: https://haveibeenpwned.com/api/v3/breach/CannabisForum