ForumCommunity Breach Exposes 776K Email Addresses, Usernames, and Unsalted MD5 Password Hashes
What Happened — In mid‑2016 the Italian‑based forum‑hosting service ForumCommunity suffered a data breach that released 776,648 unique email addresses, usernames, and unsalted MD5 password hashes. The breach was disclosed via Have I Been Pwned; ForumCommunity did not respond to inquiries.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of weak credential storage — unsalted MD5 hashes are trivially cracked, violating best‑practice password‑protection controls.
- Highlights the need for continuous evidence that authentication mechanisms meet strong hashing and salting standards, a core element of a control‑assurance program.
- Shows why ongoing vendor oversight and credential‑management audits are essential to maintain a defensible audit trail.
Who Is Affected – SaaS platforms that host user‑generated content, online community providers, and any organization that re‑uses credentials from such services.
Recommended Actions
- Inventory all password‑storage mechanisms; replace unsalted MD5 with salted, adaptive hashing (e.g., bcrypt, Argon2).
- Enforce mandatory password resets for any accounts that may have been compromised.
- Implement continuous monitoring of credential‑storage controls and retain evidence for audit readiness. Source: Have I Been Pwned – ForumCommunity breach
Technical Notes – The breach exposed email addresses, usernames, and MD5 password hashes that were stored without salting, making them vulnerable to rapid offline cracking. No specific vulnerability (CVE) was disclosed; the root cause appears to be insecure credential‑storage practices. Source: same as above