The divinationX Breach Happened in 2014. It’s Still Circulating.

HEROIC analysts identified 2,410 exposed accounts tied to divinationX, a gaming site breach dated December 31, 2014. Despite its small size, this breach exposed an unusually complete set of personal data, including full names, phone numbers, email addresses, usernames, IP addresses, and password hashes.

Why This Small Breach Carries an Outsized Risk

What makes the divinationX breach notable isn't its size but its depth. Along with login credentials, it exposed first and last names, phone numbers, and IP addresses, the kind of personal detail that lets an attacker build a convincing profile of a real person rather than just a username and password. The passwords themselves were hashed using the MD5(PHPBB3) format, an older scheme that is no longer considered secure against modern cracking techniques.

What Was Exposed in the divinationX Breach

• Email addresses
• Usernames
• IP addresses
• Phone numbers
• First and last names
• Password hashes (MD5 PHPBB3 format)

Why This Matters for divinationX Users

Names, phone numbers, and email addresses in the wrong hands can fuel targeted phishing attempts, since a message that includes your real name and phone number feels far more legitimate than a generic scam email. Combined with a cracked password, this breach gives attackers the raw materials for account takeover and identity theft, even a decade after the original incident.

How This Database Breach Happened

This incident is classified as a database breach, meaning attackers gained direct access to divinationX's user database rather than collecting data through malware. Sites running phpBB forum software during this period were a common target for attackers exploiting unpatched vulnerabilities. Once inside, attackers can export the full user table, capturing every field the site stored, in this case names, phone numbers, IP addresses, and hashed passwords, in one file that can be copied and resold indefinitely.

Check If You Are Affected by the divinationX Breach

You don't need to guess whether your information was part of the divinationX breach or any other leak. HEROIC's free breach scanner checks your email address against a database of more than 400 billion leaked records and shows you exactly what was exposed. If you find a match, change the password on any account still using it and enable multi-factor authentication where you can.