MajorGeeks Forum Breach Exposes 269,548 User Credentials and IP Addresses
What Happened — In November 2015 the support forum for MajorGeeks was compromised, resulting in the theft of nearly 270 k user accounts. The leaked data included email addresses, usernames, salted password hashes, and originating IP addresses. The compromised credentials have since been observed for sale on underground markets.
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous credential monitoring and rapid revocation—core elements of an identity‑access control program.
- Provides a real‑world example of why organizations must retain defensible evidence of breach detection, response, and remediation for audit readiness.
- Reinforces the importance of enforcing strong authentication (e.g., MFA) and regular password hygiene as part of a control‑assurance posture.
Who Is Affected — Online consumer‑software platforms, SaaS providers with user forums, and any organization that stores credential data for end‑users.
Recommended Actions
- Cross‑reference exposed credentials with your user database; force password resets for any matches.
- Deploy multi‑factor authentication and implement continuous monitoring for anomalous login activity.
- Review logging, detection, and incident‑response playbooks; document actions taken to satisfy audit evidence requirements.
Source: Have I Been Pwned – MajorGeeks breach
Technical Notes — The exact attack vector remains unknown; the breach exposed salted password hashes (likely using legacy hashing algorithms) along with email, username, and IP address metadata. No CVE is associated.