vBulletin Forum Breach Exposes 178 K Accounts from The Candid Board
What Happened — In September 2015 the adult‑content forum “The Candid Board” was compromised. Attackers gained access to the underlying vBulletin installation and extracted 178,201 user records, including email addresses, IP addresses, dates of birth, usernames and passwords hashed with MD5 (salted).
Why It Matters for Trust & Control Assurance
- Unpatched or mis‑configured forum software creates a control gap that a continuous‑control‑assurance program must detect, document, and remediate.
- Exposure of credential hashes highlights the need for strong password‑storage policies and evidence of compliance with hashing standards.
- Demonstrating timely patch management and evidence of remediation is essential for a defensible audit trail.
Who Is Affected — Adult‑entertainment / online community platforms that rely on legacy forum software (e.g., vBulletin).
Recommended Actions
- Inventory all forum and CMS instances; verify they run supported versions and apply vendor patches.
- Replace weak hashing (MD5) with modern algorithms (bcrypt, Argon2) and re‑hash existing passwords.
- Enable continuous monitoring of software inventory and patch status; retain evidence for audit readiness.
- Conduct a credential‑reuse check against known breach databases and enforce multi‑factor authentication where possible.
Technical Notes — The breach leveraged a known vulnerability in an outdated vBulletin release; attackers harvested user‑profile data and MD5‑hashed passwords. Source: Have I Been Pwned – The Candid Board breach