The CardingMafia Leak: 149,728 Accounts From a Samoa-Hosted Forum

HEROIC analysts identified a database leak tied to CardingMafia (cardingmafia.ws), a carding-focused forum. The breach is dated January 31, 2016, and exposed 149,728 records, including email addresses, usernames, IP addresses, passwords, and the hash type used to protect them, built on the vBulletin forum platform.

Why a Breach of a Carding Forum Is Especially Notable

CardingMafia was itself a forum built around carding activity, and its own user base getting breached adds an extra layer to this leak. With nearly 150,000 records exposed, including IP addresses that can help narrow down a user's location, this is a sizeable dataset that gives attackers both login credentials and identifying details to work with.

What Was Exposed in the CardingMafia Database

• Email addresses
• Usernames
• Passwords (vBulletin hash format)
• IP addresses
• Hash type metadata

Why This Matters for Anyone in This Data Set

Regardless of what a forum was used for, the same email and password reuse problem applies to everyone registered on it. If any of these 149,728 accounts used the same login somewhere else, attackers can run that credential through credential stuffing tools that test it across other services automatically, hoping for a match that leads to account takeover.

How This vBulletin Database Breach Happened

This incident is recorded as a database breach involving vBulletin, one of the most widely used forum platforms. Sites running vBulletin have historically been compromised through outdated plugins or unpatched software vulnerabilities, giving attackers a path to copy the entire user table, hashed passwords included, directly out of the database. Once extracted, weaker hashes can be cracked and turned into usable plaintext passwords.

Check If You Are Affected

If you've ever registered on a forum with an email and password you've reused elsewhere, it's worth checking your exposure. HEROIC's free breach scanner checks your email against more than 400 billion leaked records, so you can see what's out there and update any passwords still in use.