CannabisForum

We've been tracking a steady rise in forum database leaks appearing on dark web marketplaces, often fueled by older software versions and lax security practices. What caught our attention with the recent CannabisForum breach wasn't the size of the user base, but the unusually detailed user profiles and the relatively active nature of the community. The data had been circulating quietly on a lesser-known forum for several weeks before we observed it being repackaged and offered for sale on a more prominent Telegram channel. The setup here felt different because the exposed data included not just usernames and passwords, but also detailed personal interests and locations, potentially creating a rich target for social engineering or highly targeted phishing campaigns.

CannabisForum Breach: 1.4 Million User Records Exposed

A database dump from CannabisForum, a popular online community dedicated to cannabis-related discussions, has been circulating in underground channels. The breach exposed 1.4 million user records, offering a granular look into the platform's user base. The data first appeared on a smaller forum in late October 2024 before being amplified on a Telegram channel known for trading leaked databases. What makes this breach particularly concerning is the combination of detailed user profiles and the sensitive nature of the forum's topic, which could expose users to unwanted scrutiny or even legal repercussions depending on their location. This incident highlights the ongoing risk associated with online communities and the need for robust security measures to protect user data. It underscores the value of even niche communities to threat actors.

Breach Stats:

* **Total records exposed:** 1.4 million
* **Types of data included:** Usernames, email addresses, hashed passwords (likely using older hashing algorithms), IP addresses, forum activity logs, personal interests (e.g., strains, growing techniques), and location data (city, state).
* **Sensitive content types:** Potentially PII depending on user profiles; forum posts revealing personal experiences.
* **Source structure:** SQL database dump.
* **Leak location(s):** Initial appearance on a smaller forum, then repackaged and sold on a Telegram channel.

The breach has also been discussed on BreachForums, where users have been analyzing the data and verifying its authenticity. One user noted that the password hashes appear to be relatively weak, increasing the risk of successful password cracking. While mainstream media outlets haven't yet picked up the story, the chatter within the security community indicates a growing awareness of the breach and its potential impact. This event is another example of the increasing automation of attacks against online forums, where attackers are using automated tools to identify and exploit vulnerabilities in older forum software. This is often coupled with credential stuffing attempts on other services.