iPmart Forum Breach Exposes 2.46 M User Accounts, Including Weakly Hashed Passwords
What Happened – In 2015 the iPmart forum (now Mobi NUKE) was compromised, leaking personal data for more than 2 million members. The breach disclosed email addresses, usernames, dates of birth and password hashes that were salted but generated with a weak algorithm, allowing many passwords to be cracked quickly. A follow‑up addition in March 2016 brought the total exposed records to 2,460,787.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate credential‑storage controls – a core control objective for any continuous assurance program.
- Highlights the need for ongoing evidence that password‑hashing mechanisms meet strong cryptographic standards and are regularly validated.
- Aligns with Verisq’s Access Controls capability, which helps organizations prove robust identity‑management and credential‑protection practices to auditors and regulators.
Who Is Affected – Online community platforms, SaaS forum providers, and any organization that stores user‑generated credentials in web applications.
Recommended Actions
- Conduct an immediate review of password‑hashing algorithms; replace weak implementations with industry‑accepted schemes such as Argon2, bcrypt, or scrypt.
- Force a password reset for all affected accounts and enforce multi‑factor authentication where possible.
- Capture and retain evidence of the remediation steps (hashing algorithm change, reset logs) to support audit readiness.
Technical Notes – The compromised system ran vBulletin forum software. Passwords were stored as salted hashes, but the hashing routine was weak (e.g., MD5 or SHA‑1) and allowed rapid cracking. No CVE is associated with the breach itself; the vulnerability lies in the application’s credential‑storage design.