Historic RuneScape Boards Forum Breach Exposes 222,762 User Credentials
What Happened — In 2011 the RuneScape Boards (rsboards.com) forum, built on vBulletin, was compromised. Attackers obtained 222,762 unique email addresses, usernames, IP addresses and salted MD5 password hashes, which were later redistributed as part of a larger data corpus.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of legacy platforms that store passwords with weak hashing algorithms; a continuous control‑assurance program would flag this as a non‑compliant credential‑storage control.
- Highlights the need for ongoing monitoring of access controls and credential‑management policies to provide defensible evidence during audits.
- Aligns with the Access Controls capability: enforce strong password hashing, enforce MFA, and maintain audit‑ready logs of credential‑related changes.
Who Is Affected — Users of the defunct RuneScape Boards forum (gaming community) and any organization still operating legacy forum software that may inherit similar weaknesses.
Recommended Actions
- Conduct a credential‑storage audit: verify hashing algorithms meet current best‑practice (e.g., bcrypt, Argon2).
- Force password resets for all affected accounts and enable multi‑factor authentication where possible.
- Map the credential‑storage control to your audit framework, collect evidence of remediation, and document the change in your continuous monitoring system. Source: https://haveibeenpwned.com/api/v3/breach/RSBoards
Technical Notes
- Platform: vBulletin (historical version).
- Hashing: salted MD5 (cryptographically weak, susceptible to offline cracking).
- Likely exploited via known vBulletin vulnerabilities or mis‑configuration that allowed database extraction. Source: https://haveibeenpwned.com/api/v3/breach/RSBoards