Identity Theft Got Easier After the Disqus Breach: 16M at Risk

Disqus is a US-based commenting platform embedded on millions of websites and news publications, used by over 500 million people to log in and post comments across the web. In July 2012, attackers breached Disqus's database and extracted records for nearly 17 million users. The breach went undetected for over five years until Disqus disclosed it in October 2017. The stolen data included email addresses, usernames, SHA-1 password hashes, and for some accounts, plaintext passwords stored directly, making this breach particularly damaging even years after it occured.

Why Disqus Breach Is Dangerous

A Disqus account connects your identity across every website where you've commented. Because Disqus is used on news sites, political blogs, tech publications, and other high-profile platforms, attackers who crack these credentials gain insight into your reading habits, political views, and the topics you engage with publicly. Combined with your email address and a cracked password, this profile makes targeted phishing far more precise. The presence of plaintext passwords in this breach means some credentials required no cracking at all.

What Was Exposed in the Disqus Leak

• Email Address
• Username
• Password Hash
• Plaintext Password
• Salt

Why This Disqus Data Puts You at Risk

Disqus credentials are linked to a wide range of websites. If your Disqus password was the same as your email account, social media, or any other service, attackers have had access to those combinations since 2012. Many users who logged into Disqus via their Google or Facebook accounts did not have a seperate Disqus password stored, but their email addresses were still captured in the breach. That email address can still be matched against other breaches to build a credential profile and target additional accounts.

How Plaintext Passwords in Breaches Work

When a site stores a password as plaintext, no cracking is needed. Attackers who obtained the Disqus database immediately had working passwords for the accounts where plaintext storage was used. For the SHA-1 hashed accounts, cracking tools processed the common passwords quickly, making those credentials available not long after the breach. The five-year gap between the breach and its public disclosure meant these credentials were in circulation for years before Disqus users were even notified that their data had been compromised.

Check If Your Data Was Exposed

HEROIC's free breach search checks your email against 400 billion+ compromised records, including the Disqus dataset. Search now to see if your account was included, and if you used the same password on Disqus as on any other platform, update it on those platforms as soon as possible.