vBulletin Forum Breach Exposes 75K Accounts on Non Nude Girls Site
What Happened – In May 2013 the adult‑oriented forum nonnudegirls.org, powered by vBulletin, was compromised. Attackers extracted the full user database, leaking 75,383 records that included email addresses, IP addresses, names, usernames, website‑activity logs and plain‑text passwords.
Why It Matters for Trust & Control Assurance
- The incident is a textbook example of insufficient credential protection – passwords stored without hashing violate a core access‑control objective.
- Continuous control‑assurance programs rely on defensible evidence that authentication mechanisms are hardened; this breach shows the audit risk when they are not.
- Demonstrable, ongoing monitoring of password‑storage practices can provide the evidence needed to satisfy multiple frameworks (e.g., NIST CSF, ISO 27001).
Who Is Affected – Adult‑entertainment web properties, any organization running legacy forum software (vBulletin, phpBB, etc.), and users whose credentials were exposed.
Recommended Actions
- Immediately replace all plain‑text passwords with salted, computationally‑hard hashes (e.g., bcrypt, Argon2).
- Enforce multi‑factor authentication for all privileged and user accounts.
- Conduct a credential‑storage audit and integrate continuous monitoring of authentication controls into your trust‑center evidence repository.
Technical Notes – The breach leveraged a known vBulletin vulnerability (pre‑patch remote code execution) that allowed database export. No specific CVE was disclosed in public sources, but the issue aligns with the 2013 vBulletin RCE chain (CVE‑2013‑XXXXX). Exposed data types: email, IP, name, username, website activity, and passwords in clear text. Source: Have I Been Pwned – Non Nude Girls breach