Forum Breach Exposes 366 K MrExcel User Accounts, Password Hashes and Personal Data
What Happened — In December 2016 the vBulletin forum that powers the MrExcel community was compromised. Attackers extracted 366,140 user records, including email addresses, IP addresses, dates of birth, usernames, social‑connection data and passwords stored as MD5‑hashed, salted values. The site owner later self‑submitted the data set to Have I Been Pwned.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of relying on third‑party platforms that may not follow modern credential‑storage standards.
- Highlights the need for continuous third‑party risk monitoring and evidence collection to prove due diligence.
- Shows how a single breach can undermine audit readiness across multiple frameworks if vendor controls are not verifiable.
Who Is Affected – Online community platforms, SaaS providers, and any organization that integrates third‑party forum or discussion software (primarily the technology/SaaS sector).
Recommended Actions
- Conduct a third‑party risk assessment of any external forum or content‑management system you use.
- Verify that vendors employ strong password‑hashing algorithms (e.g., bcrypt, Argon2) and enforce MFA for administrative access.
- Implement continuous monitoring of vendor security posture and retain evidence of compliance for audit purposes.
Technical Notes – The breach stemmed from exploitation of a known vBulletin vulnerability; compromised data included MD5‑hashed passwords (even with salting), email addresses, IPs, dates of birth, usernames and social‑connection metadata. Source: Have I Been Pwned – MrExcel breach