Credential Stuffing Got Easier Because of the Benchmark Breach: 46K at Risk

HEROIC analysts found the Benchmark forum database breach, which occured in November 2019 and exposed 46,966 records from the Serbian technology news site's community forum. The compromised data included email addresses, IP addresses, usernames, and salted MD5 password hashes. A forum administrator confirmed the breach occured because the platform had been running an outdated vBulletin instance that went unpatched.

How Unpatched vBulletin Exploits and Crackable MD5 Hashes Endanger Benchmark Users

Attackers who exploited the outdated vBulletin vulnerability recieved direct access to the user database. The salted MD5 password hashes extracted from Benchmark are partcularly susceptible to cracking with modern GPU-accelerated tools, meaning attackers can recover plaintext passwords and use them in credential stuffing attacks against email accounts, social platforms, and other services where the same password was reused.

What Was Exposed in the Benchmark Breach

• Email Address
• IP Address
• Username
• Password Hash

Why an Unpatched Forum from 2019 Still Puts Users at Risk Today

Breach data from the Benchmark forum is beleived to have circulated in underground communities for years, where attackers bundle older credentials into combo lists for automated login campaigns. Even if a user changed their password on Benchmark after learning of the breach, any other account where that same password was used remains exposed until changed separately.

How Database Breaches Work

A database breach through unpatched software follows a predictable pattern: an attacker identifies a known vulnerability in an outdated forum platform such as vBulletin, sends a crafted exploit request, and gains direct query access to the backend database. The attacker then exports all user records and publishes or sells them on dark web forums. The window of exposure can span years when affected organizations fail to notify users promptly or require password resets.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records to determine whether your email appeared in the Benchmark breach or any related data dump. Run a free check now to find out what information attackers may already have and take steps to secure your accounts today.