Malwarebytes Forum Breach Exposes 111K User Accounts and Password Hashes
What Happened — In November 2014 the public Malwarebytes forum (IP.Board) was compromised, resulting in the exposure of 111,623 member records. The breach included email addresses, IP addresses, dates of birth, usernames and password hashes that were stored with a weak salted‑hash implementation, allowing many passwords to be cracked quickly.
Why It Matters for Trust & Control Assurance
- Weak credential‑storage controls create a direct path for attackers to obtain usable passwords, a scenario continuous control‑assurance programs are built to prevent and evidence.
- Demonstrating robust password‑hashing, regular algorithm reviews, and documented remediation provides defensible audit evidence across multiple frameworks (e.g., NIST CSF, ISO 27001).
- Ongoing monitoring of credential‑management controls helps prove due‑diligence and reduces the risk of future data‑exposure incidents.
Who Is Affected – Security‑software vendors, SaaS platforms with community forums, and any organization that stores user credentials.
Recommended Actions
- Conduct an immediate audit of password‑storage mechanisms; replace weak hashes with memory‑hard algorithms (e.g., Argon2, bcrypt).
- Force password resets for all affected accounts and enable multi‑factor authentication on forum access.
- Capture remediation steps, configuration changes, and test results as evidence for control‑assurance reporting. Source: [HIBP breach record]
Technical Notes – The attack leveraged a vulnerability in the forum’s password‑hashing implementation (weak salted hashes) rather than a classic exploit; exposed data types included DOB, email, IP, usernames, and password hashes. Source: [HIBP breach record]