Our Analysts Found the ArenaBG Forum Dump in Private Telegram Channels

ArenaBG Forum (forum.arenabg.com) was the discussion community for ArenaBG, a Bulgarian-language BitTorrent tracker and file-sharing platform. In November 2012, the forum's database was breached, exposing 18,469 user accounts. The stolen data included email addresses, IP addresses, and vBulletin password hashes. Torrent site forum members are particuarly sensitive to IP address exposure because that data can be used to identify the approximate location and internet service provider of individuals who prefer to keep their online activities private.

Why ArenaBG Forum Breach Is Dangerous

vBulletin password hashes from 2012 are readily crackable with modern tools, especially for passwords that follow common patterns. The IP address data in this breach is uniquely sensitive for a torrenting community: users of torrent sites often take steps to conceal their identity, and an exposed IP address from a logged-in forum session undermines that effort. Email addresses tied to this platform can also be cross-referenced against other breach datasets to build fuller profiles of individuals who value anonymity.

What Was Exposed in the ArenaBG Forum Leak

• Email Address
• IP Address
• Password Hash (vBulletin)

Why This ArenaBG Forum Data Puts You at Risk

If you registered on ArenaBG Forum before 2012 and used the same email and password on other platforms, those credentials should be considered compromised. The password hash is the same format used across all vBulletin-based forums from that era, meaning the same cracking tools that work on one dataset work on all of them. An attacker who cracks your ArenaBG Forum password has a template for testing your email against email providers, social networks, and any account that used that same password.

How Torrenting Forum Breaches Expose Privacy-Conscious Users

Users who join torrent site forums often assume a degree of separation between their online identity and their real identity. But forum registration requires an email address, and forum sessions log IP addresses. The ArenaBG Forum breach occured before VPN use was widespread among regular internet users, meaning the IP addresses logged at registration time are likely real, unmasked addresses. This data, even a decade later, can be used to connect a username to an approximate geographic location and an internet service provider.

Check If Your Data Was Exposed

HEROIC's free breach search checks your email against 400 billion+ compromised records, including the ArenaBG Forum dataset. Search now to see if your account was included. If your email appears, change any account password that matches what you used on this forum immediatly.