vBulletin Forum Software Breach Exposes 518,966 User Accounts
What Happened – In November 2015 the forum‑software vendor vBulletin suffered a data breach that released 518,966 user and customer records. The exposed data included email addresses, dates of birth, security‑question answers, salted password hashes, IP addresses, instant‑messenger IDs and other profile details.
Why It Matters for Trust & Control Assurance
- The incident illustrates the risk of relying on third‑party platforms that lack demonstrable security controls.
- Continuous vendor‑risk monitoring and evidence of control implementation are essential to prove due‑diligence during audits.
- A defensible audit trail of vendor assessments helps organizations respond quickly when a supplier breach occurs.
Who Is Affected – Companies that host public or private forums on vBulletin, SaaS providers that embed the software, and any downstream customers whose user data resides in the compromised database.
Recommended Actions
- Initiate a third‑party risk review of vBulletin (or any similar forum platform) and request up‑to‑date security attestations.
- Verify that password storage follows modern hashing standards (e.g., Argon2, bcrypt) and that security‑question mechanisms are phased out.
- Update incident‑response playbooks to include supplier‑breach scenarios and ensure logging of all vendor‑related access.
Technical Notes – The breach appears to have been caused by an unknown attack vector that allowed extraction of the user database. No specific CVE or vulnerability was disclosed. Exposed data types: email, DOB, IP, instant‑messenger IDs, salted password hashes, security‑question answers, spoken languages, website activity. Source: Have I Been Pwned – vBulletin breach