Social Engineered Forum Breach Exposes 89,392 User Accounts, Password Hashes, and Private Messages
What Happened — In June 2019 the “Art of Human Hacking” site Social Engineered suffered a breach of its MyBB forum. Attackers obtained a database dump containing 89,392 unique records, including email addresses, usernames, IP addresses, private messages, and passwords stored as salted MD5 hashes.
Why It Matters for Trust & Control Assurance
- The incident is a textbook example of why continuous credential‑management and strong hashing standards are required in any control‑assurance program.
- It underscores the need for documented access‑control policies and evidence that authentication mechanisms are regularly validated.
- Demonstrates the value of ongoing monitoring and audit‑ready evidence to prove that credential storage meets industry‑accepted security baselines.
Who Is Affected
- Operators of community forums and SaaS platforms that store user credentials.
- Organizations that rely on legacy authentication stacks (e.g., MD5‑based hashes).
Recommended Actions
- Replace weak salted MD5 hashes with modern adaptive algorithms such as bcrypt, Argon2, or scrypt.
- Enforce multi‑factor authentication for all privileged and user accounts.
- Conduct a credential‑storage audit, document the hashing methodology, and collect evidence for continuous monitoring.
Technical Notes
- Attack vector: unknown (likely exploitation of a MyBB vulnerability or credential reuse).
- Data types exposed: email addresses, usernames, IP addresses, private messages, password hashes (salted MD5).
- No public CVE linked to this specific breach; the exposure stems from insecure password storage and insufficient access controls.