If You Played on Cfire.mail.ru, 3.4 Million Accounts Were Leaked

HEROIC analysts flagged the Cfire.mail.ru Forums database while reviewing a wave of Russian gaming community data circulating on underground markets. Cfire.mail.ru was a gaming forum operated under the Mail.ru umbrella, one of Russia's largest internet companies. The breach, which occured in August 2016, exposed 3,476,957 user records protected with vBulletin password hashing. The scale of this breach is significant: nearly 3.5 million accounts from a single Russian gaming community, all accessable in a clean, structured database dump.

What vBulletin Password Hashing Means for Cfire.mail.ru Users

vBulletin is forum software that has historically used MD5-based password hashing, often without adequate salting depending on the version in use at the time. Attackers who obtain a vBulletin database can attempt to crack these hashes using dictionary attacks, rainbow tables, or brute-force tools. Users who registered on Cfire.mail.ru with a commonly used password, or who reused that same password elsewhere, are partcularly vulnerable to having their credentials recovered and exploited on other platforms.

What Was Exposed in the Cfire.mail.ru Forums Breach

• User account records (3,476,957 total)
• Email addresses
• Usernames
• vBulletin-hashed passwords

Why 3.4 Million Gaming Forum Accounts Are a Real-World Threat

Gaming forum users often register with the same email and password they use across many other services. With 3.4 million accounts in this database, attackers have a large pool of credentials to test against email providers, social media platforms, financial services, and other gaming accounts. Credential stuffing, account takeover, and identity fraud are the most direct risks. The fact that this breach is tied to Mail.ru, a major Russian internet ecosystem, also means that beleive it or not, some of these accounts may still be active and tied to live Mail.ru services.

How Database Breaches Work

A database breach occurs when an attacker gains unauthorized access to the backend storage system of a web platform. Forum software like vBulletin stores all user registration data in a central database. An attacker who finds a vulnerability in the forum software, or who compromises an administrator account, can export the entire user database. Once that file is in the attacker's hands, it can be cracked, traded, or used in automated credential stuffing campaigns without the affected platform ever knowing the data is in circulation.

Check If Your Data Was Exposed

HEROIC's breach scanner searches more than 400 billion records, including the full Cfire.mail.ru Forums database. If you ever registered on this forum or used a Mail.ru-connected account, check your exposure now at heroic.com/breach-check. It is free and takes seconds.