Inattack Forum Breach: 22,946 Logins Could Unlock More Accounts

Inattack Forum Breach: 22,946 Logins Could Unlock More Accounts

HEROIC analysts have identified a data breach affecting Inattack Forum, an online community focused on hacking discussion, that exposed 22,946 user records. The compromised data includes email addresses, usernames, IP addresses, and password hashes in the IPB format, with the breach dating back to August 2015.

Why One Password Can Unlock Several Accounts

The IPB hash format used by Inattack Forum was standard for Invision Power Board software but is now considered outdated. With enough computing power, these hashes can be cracked, especially for passwords that are short or reused from other sites. Once cracked, a single password can act as a key for every other account where a member used the same one, from email to other forums or even work accounts.

What Was Exposed

• Email addresses
• Usernames
• IP addresses
• Password hashes (IPB format)

Why This Matters

Attackers who obtain a working email and password pair from a breach like this will typically run it against dozens of other websites through credential stuffing. Combined with an exposed IP address, this data can also help build a more targeted phishing attempt aimed at a specific person rather than a generic scam, which makes it more likely to succeed.

How a Forum Database Breach Like This Happens

This incident is classified as a database breach, meaning an attacker obtained direct access to Inattack Forum's user database rather than targeting individual members one by one. This usually happens through unpatched forum software, stolen admin credentials, or an exposed server. Once inside, the attacker can copy every user record in the database at once, which is why breaches like this expose full sets of usernames, emails, and password hashes rather than a handful of accounts.

Check If You Are Affected

If you ever had an account on Inattack Forum, or if you reuse the same password across different sites, now is a good time to check. HEROIC's free breach scanner checks your email against more than 400 billion breached records, including this one, so you know where you stand and can update any passwords that are still in use elsewhere.