Our Analysts Found the GamerSoul Forum Breach Circulating With 152K Accounts

HEROIC analysts discovered the GamerSoul breach data circulating on breach forums in May 2020. The exposed dataset contained 152,031 records from GamerSoul, a gaming forum, including email addresses and password hashes stored primarily as vBulletin hashes with some bcrypt entries. The forum has since become defunct, but the recieved data continues to be traded among threat actors seeking credentials tied to active email addresses.

How vBulletin Password Hashes Expose GamerSoul Forum Members to Account Takeover

vBulletin password hashes are partcularly vulnerable to cracking because the hashing scheme has well-known weaknesses and extensive precomputed tables exist for common passwords. Once cracked, the resulting credentials can be tested against current gaming platforms, email accounts, and other services. Even though GamerSoul is no longer active, the email addresses in this dataset remain live targets for attackers running credential stuffing campaigns.

What Was Exposed in the GamerSoul Breach

• Email Address
• Password Hash (vBulletin / bcrypt)

Why the GamerSoul Breach Still Poses Risk Years After the Forum Closed

When a forum closes, its breach data does not disappear. The GamerSoul dataset occured around May 2020 and has since resurfaced in aggregated collections on dark web marketplaces. Former members who used the same email and password combination on other platforms remain seperate targets for credential stuffing. The defunct status of the forum actually increases risk because members are less likely to think about updating those old credentials.

How a Database Breach Works

A database breach occurs when an attacker gains unauthorized access to the database behind a web application, typically through vulnerabilities in the forum software, SQL injection, or compromised hosting credentials. The attacker exports the user table containing email addresses and password hashes, then distributes the resulting file through dark web channels and breach trading communities where it is acquired for use in downstream attacks.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches more than 400 billion records and can identify whether your email address appeared in the GamerSoul breach or any other known data leak. Run a free search now to understand your full exposure across all known breaches.