Dark Web Intel: 696,802 Credentials From the Onverse Forum Breach

HEROIC analysts identified a late 2015 data breach tied to the Onverse Forum, connected to the Onverse virtual world platform, that exposed 696,802 accounts. The compromised records include usernames, email addresses, IP addresses, and password hashes protected with vBulletin (vB) hashing.

Why This Is Dangerous

vBulletin password hashing was standard for forum software years ago, but it is now considered outdated and can be cracked far more easily than modern hashing methods like bcrypt. Once an attacker recovers a working password, they can pair it with the matching email address or username and attempt to log into other accounts elsewhere.

What Was Exposed

• Usernames
• Email addresses
• IP addresses
• Password hashes (vBulletin)

Why This Matters

Onverse was a virtual world platform where users built profiles, connected with others, and often reused login details across similar online communities. If an Onverse Forum member reused their password on an email account, a game, or a social platform, that account remains at risk of takeover today. The included IP addresses also give attackers a way to build a more complete picture of a specific person's online activity.

How This Database Breach Happened

This incident is classified as a database breach, meaning attackers gained direct access to the forum's user database rather than collecting credentials one at a time. Forums running older vBulletin installations have historically been common targets for attackers exploiting known software vulnerabilities. Once inside, an attacker can copy the entire user table in a single move, which is how one incident exposed nearly 700,000 accounts.

Check If You Are Affected

If you ever had an account on the Onverse Forum or the Onverse virtual world, it is worth checking whether your information is part of this exposure. HEROIC's free breach scanner checks a database of more than 400 billion leaked records, so you can see instantly if your email address turns up and change any passwords you may still be reusing.