Blog Commenters Targeted: The Disqus 2023 Breach Hit 4.9 Million Users

HEROIC analysts found nearly 5 million user records from Disqus, the widely used blog comment hosting platform, surfacing on dark web forums. The data was publicly flagged on April 23, 2023, and contained 4,965,403 records. What made this discovery especially alarming was that the exposed credentials included plaintext passwords, meaning anyone who obtained the dataset could immediately attempt logins without any additional cracking effort.

Forum Commenters and Blog Users Are Prime Targets in This Breach

Disqus powers comment sections across thousands of websites, which means the affected accounts are not tied to just one community. A threat actor holding this dataset can target users of news sites, political blogs, entertainment platforms, and more. With both email addresses and working passwords in hand, attackers can log in directly to Disqus accounts and, more dangerously, test those same credentials against email providers, social networks, and financial platforms. People who reused their Disqus password anywhere else are accessable to attackers right now.

What Was Exposed in the Disqus (2023) Breach

• Email addresses
• Plaintext passwords

Why Plaintext Passwords Make This Breach Especially Dangerous

Most platforms store passwords as hashed values, which at least forces attackers to crack them before using them. Disqus stored passwords in plaintext, which means zero barrier between the breach and account takeover. Credential stuffing tools can automatically test these email and password pairs across hundreds of services in minutes. The risk extends well beyond Disqus itself. Anyone who used the same password on their bank, email, or social media accounts is at elevated risk of account takeover and identity fraud.

How Plaintext Password Breaches Work

A plaintext password breach occured when a platform fails to hash or encrypt user credentials before storing them. When an attacker gains access to that database through SQL injection, insider access, or a misconfigured server, they walk away with immediately usable login credentials. There is no need to brute-force anything. Automated credential stuffing tools then cycle through those email and password pairs across major platforms, and even a low success rate across millions of records yields thousands of compromised accounts.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion recieved and indexed records, including the Disqus dataset. If your email appeared in this breach, you will know immediately. Visit HEROIC to run a free scan and see exactly what information about you is already in the hands of threat actors.