The Malwarebytes Forum Breach: 94,867 Accounts Exposed in 2015

HEROIC analysts identified a 2015 data breach tied to the Malwarebytes support forum that exposed 94,867 accounts. The compromised records include email addresses, usernames, IP addresses, and password hashes secured with the IP.Board (IPB) hashing method.

Why This Is Dangerous

IP.Board's hashing method is considered weak by modern standards and can be cracked far more easily than current password hashing algorithms. Once an attacker recovers a working password, they can pair it with the matching email address or username and attempt to log into other accounts elsewhere.

What Was Exposed

• Email addresses
• Usernames
• IP addresses
• Password hashes (IP.Board)

Why This Matters

Malwarebytes is a well known security software company, and its forum users are exactly the kind of people who might assume they are less vulnerable to this sort of thing. That assumption does not hold up: forum software is a separate system from the antivirus product itself, and a breach here carries the same account takeover risk as any other forum leak. If a member reused their forum password anywhere else, that account is now at risk.

How This Database Breach Happened

This incident is classified as a database breach, meaning attackers gained direct access to the forum's user database rather than collecting credentials one at a time. Forums running IP.Board software have historically been targeted for known vulnerabilities. Once inside, an attacker can copy the entire user table in a single move, exposing usernames, emails, IP addresses, and password data together.

Check If You Are Affected

If you ever had an account on the Malwarebytes support forum, especially around 2015, it is worth checking whether your information is part of this exposure. HEROIC's free breach scanner checks a database of more than 400 billion leaked records, so you can see instantly if your email address turns up and change any passwords you may still be reusing.