The Linux Mint Forum Breach Contains Exactly 123,149 Exposed Accounts

HEROIC analysts identified a database breach affecting LinuxMint, tied to a 2016 attack in which the Linux Mint website was compromised and its ISO download was infected with a backdoor. The same incident led to the sale of the site's phpBB forum database, exposing 123,149 records, including email addresses, usernames, IP addresses, and passwords hashed using phpBB's hashing method.

Why the Linux Mint Forum Breach Is Dangerous

This breach is notable because it targeted a technically savvy user base, people who downloaded and installed a Linux operating system, many of whom likely reused strong-looking but ultimately repeated passwords across accounts. Combined with real email addresses, IP addresses, and usernames, this data gives attackers a complete profile to attempt account takeover well beyond the Linux Mint forum itself.

What Was Exposed in the Linux Mint Forum Breach

• Email addresses
• Usernames
• IP addresses
• Passwords (hashed via phpBB)

Why This Matters

Password hashes generated by older phpBB installations can be cracked using widely available tools, particularly for passwords that are short, common, or reused from other sites. Once an attacker recovers a working password, they can attempt to log into other services using the same email and password combination, a technique known as credential stuffing. Anyone who registered on the Linux Mint forum around 2016 should assume any password used there has since been exposed.

How This Database Breach Happened

This breach originated when attackers compromised the Linux Mint website itself, going as far as replacing a legitimate download link with a backdoored version of the operating system. The same access allowed the attackers to extract the forum's full database, including hashed passwords, usernames, email addresses, and IP addresses, before offering the data for sale.

Check If You Are Affected

If you ever created an account on the Linux Mint forum, especially around 2016, it's worth checking whether your information was included in this breach. HEROIC's free breach scanner searches a database of more than 400 billion leaked records, so you can find out where your email address has appeared and update any passwords still at risk.