Anon Hackers Forum Breach Leaked 4,761 Members’ Login Credentials

Anon Hackers Forum Breach Leaked 4,761 Members' Login Credentials

HEROIC analysts have identified a data breach connected to Anon Hackers, an online forum focused on hacking and cybersecurity discussion, that exposed 4,761 user records. The compromised data includes email addresses, usernames, IP addresses, and password hashes stored in the vBulletin (vB) format, with the breach dating back to August 2015.

Why a Hacking Forum Breach Carries Extra Risk

Members of forums built around hacking and cybersecurity topics often hold accounts on other technical platforms, and some may reuse the same login across multiple sites. The exposed vBulletin password hashes can be cracked with widely available tools, particularly for passwords that are short or commonly used, turning a stolen hash back into a working password.

What Was Exposed

• Email addresses
• Usernames
• IP addresses
• Password hashes (vBulletin format)

Why This Matters

When attackers recover a working password from a breach like this, they attempt it across other services in an automated process known as credential stuffing. Because IP addresses were also exposed, attackers can build a fuller picture of a person's location and online habits, which can support more convincing phishing attempts or account takeover efforts.

How a Forum Database Breach Like This Happens

This incident is classified as a database breach, meaning an attacker gained direct access to Anon Hackers' user database rather than compromising individual accounts one at a time. Forum software running outdated versions or unpatched plugins is a common entry point for this kind of attack. Once inside, the attacker can export the full list of usernames, emails, IP addresses, and password hashes in a single action.

Check If You Are Affected

If you ever registered on Anon Hackers, or if you reuse passwords across forums and other accounts, it is worth checking your exposure now. HEROIC's free breach scanner checks your email against more than 400 billion breached records, including this one, so you can find out and update any reused passwords before they are used against you.