Mac Forums Breach Exposes 326,714 User Accounts, Including Password Hashes
What Happened – In July 2016 the Mac Forums website (vBulletin‑based) was compromised, leaking 326,714 user records that contained usernames, email addresses, IP addresses, dates of birth, and passwords stored as salted MD5 hashes. The data appeared for sale on a hacking forum, and the site’s operators did not respond to outreach.
Why It Matters for Trust & Control Assurance
- Highlights the risk of weak credential‑storage practices – a control objective that continuous monitoring programs must verify.
- Demonstrates the need for documented oversight of third‑party platforms (vBulletin) to provide defensible audit evidence.
- Shows how a lack of incident‑response visibility can impede timely evidence collection for compliance reviews.
Who Is Affected – Online community platforms, SaaS forums, and any organization relying on legacy web‑forum software.
Recommended Actions
- Replace salted MD5 password hashing with a modern algorithm (e.g., Argon2, bcrypt).
- Institute regular reviews of credential‑storage configurations and maintain logs as audit evidence.
- Deploy a third‑party risk monitoring process that continuously validates the security posture of hosted software. Source: https://haveibeenpwned.com/api/v3/breach/MacForums
Technical Notes – Attack vector appears to be a misconfiguration or exploitation of an outdated vBulletin installation; no specific CVE was disclosed. Exposed data types: usernames, email addresses, IP addresses, dates of birth, and password hashes. Source: https://haveibeenpwned.com/api/v3/breach/MacForums