2.6 M User Accounts Exposed in GSM Hosting vBulletin Forum Breach
What Happened — In August 2016, attackers accessed the vBulletin forum hosted by GSM Hosting and later sold the data. The breach exposed 2,607,440 records containing email addresses, IP addresses, usernames and salted MD5 password hashes.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of un‑monitored third‑party software components; a continuous control‑assurance program would flag missing patches or insecure configurations before data is exfiltrated.
- Highlights the need for strong credential protection and evidence of hashing standards as part of an auditable identity‑security control set.
- Provides a concrete incident that can be used to validate your vendor‑risk monitoring and incident‑response evidence collection.
Who Is Affected – Cloud‑hosting providers, SaaS platforms that embed forum or community software, and the millions of end‑users whose credentials were stored.
Recommended Actions –
- Force password resets for all affected accounts and migrate to a modern, salted‑hash algorithm (e.g., Argon2).
- Conduct a third‑party component inventory; verify that all forum software is running supported, patched versions.
- Capture remediation evidence (patch tickets, configuration baselines) to support audit readiness.
Technical Notes – The compromised system ran an outdated vBulletin version vulnerable to remote code execution (e.g., CVE‑2016‑10033). Attackers likely leveraged this flaw to extract the database. Source: [Have I Been Pwned – GSM Hosting breach]