HackForums LulzSec Breach: 163K Forum Accounts Exposed

HEROIC's DarkHive intelligence system tracked the HackForums data breach, exposing 162,503 records. The breach occured in June 2011 when the hacker group LulzSec released the data as part of their publicized "50 days of lulz" campaign. Compromised data included email addresses, usernames, and MyBB password hashes from this US-based hacking forum.

Why This Is Dangerous

HackForums was a major gathering point for cybercriminals, meaning many affected users were themselves involved in hacking communities and likely reused credentials across sensitive platforms. MyBB password hashes from 2011 are crackable with modern tools, and the email addresses from this breach have been used to target forum members with phishing campaigns designed to compromise their other accounts. The intersection of hacker identities with exposed credentials makes this a particularly high-value dataset for adversarial actors.

What Was Exposed

• Email Address
• Username
• Password Hash (MyBB format)

Why This Matters

Even a breach from a hacking forum carries serious risk for ordinary users who may have registered to lurk or learn. Forum members who reused thier HackForums email and password on other services face account takeover risk. The data has been incorporated into large credential stuffing collections that target email providers, gaming platforms, and corporate login portals. This breach continues to appear in aggregated dumps over a decade after the original LulzSec leak.

How Database Breaches Work

LulzSec operated by exploiting web application vulnerabilities to extract databases from high-profile targets. The group then published the raw data publicly to maximize attention and embarrassment. In the HackForums case, the forum's own MyBB database was extracted, compressed, and released alongside other breach data as part of a coordinated publicity campaign. The seperate leaks were combined into a single dump that circulated widely and has since been merged into multiple credential aggregation projects.

Check If You Are Affected

HEROIC offers a free identity scanner that searches over 400 billion records, including data from breaches like HackForums. Visit heroic.com to scan your email address and find out if your information was exposed.