Xbox 360 Forum Breach Exposes 1.3M Accounts and Password Hashes
What Happened — In September 2015 the Xbox360ISO vBulletin forum was compromised, leaking email addresses, IP addresses, usernames and salted MD5 password hashes for 1,296,959 accounts.
Why It Matters for Trust & Control Assurance —
- Credential exposure demonstrates a failure in password‑storage controls that continuous assurance programs must verify.
- The incident shows the need for ongoing third‑party monitoring to collect evidence of security hygiene.
- Defensible audit trails around hashing algorithms and access‑control policies are essential for meeting multiple framework objectives.
Who Is Affected — Gaming community users and operators of online forums or similar community platforms.
Recommended Actions — Force password resets for all affected accounts, upgrade password storage to modern hashing (e.g., bcrypt, Argon2), enable multi‑factor authentication for forum logins, and incorporate the forum into a continuous third‑party risk monitoring program. Source: https://haveibeenpwned.com/api/v3/breach/Xbox360ISO
Technical Notes — The breach originated from a compromised vBulletin installation; exposed data includes email, IP, username and salted MD5 password hashes. Source: https://haveibeenpwned.com/api/v3/breach/Xbox360ISO