XKCD Forum Breach Exposes 562 k User Credentials
What Happened
In July 2019 the phpBB‑based forum for the XKCD webcomic was compromised, leaking 561,991 user records. The breach disclosed usernames, email addresses, IP addresses and passwords stored as MD5 hashes (phpBB3 format).
Why It Matters for Compliance & Audit Readiness
- Highlights the control‑assurance need to enforce strong password‑hashing algorithms and timely patching of forum software.
- Demonstrates how continuous monitoring and defensible evidence collection can surface un‑encrypted credential exposure before it escalates.
- Serves as a concrete scenario for documenting remediation steps in audit trails (e.g., password‑policy updates, vendor patch‑management).
Who Is Affected
- Individual subscribers of the XKCD forum (across all industries).
- Organizations whose employees reused the exposed credentials on corporate systems.
Recommended Actions
- Prompt all users to reset passwords and enforce multi‑factor authentication where possible.
- Review and upgrade password‑hashing mechanisms (replace MD5 with bcrypt, Argon2, etc.).
- Verify that the phpBB platform is fully patched; implement a regular vulnerability‑scanning cadence.
- Document the incident response steps and update audit evidence to reflect remediation.
Technical Notes
- Attack vector: Likely exploitation of an unpatched phpBB vulnerability; exact method not disclosed.
- CVEs: None cited in the public report.
- Data types exposed: Usernames, email addresses, IP addresses, password hashes (MD5).
Source: https://haveibeenpwned.com/api/v3/breach/XKCD