The Plex Forum Breach Exposed Exactly 280,185 Password Hashes

The Plex Forum Breach Exposed Exactly 280,185 Password Hashes

HEROIC analysts have identified a data breach affecting the Plex discussion forum that exposed 280,185 user records. The breach dates back to July 2015 and the compromised data includes IP addresses, email addresses, usernames, and password hashes stored in the IPB format.

Why a Weak Hashing Implementation Makes This Breach Worse

The IPB format used to protect these passwords is considered outdated by modern standards, and a weak implementation can make it possible to crack a large share of the hashes relatively quickly. That means even years after this breach, a meaningful number of the original passwords may already have been recovered by attackers and reused elsewhere.

What Was Exposed

• IP addresses
• Email addresses
• Usernames
• Password hashes (IPB format)

Why This Matters

Even if you changed your Plex password after 2015, this breach still matters if you used that same password anywhere else at the time, since attackers frequently pair old breach data with credential stuffing tools to test logins across many other sites at once. The exposed IP addresses also add a layer of risk by revealing roughly where an account holder was located.

How a Forum Database Breach Like This Happens

This incident is classified as a database breach, meaning attackers gained direct access to the forum's user database rather than intercepting individual logins one at a time. Forum software running an outdated or unpatched version is a common target for this kind of attack, allowing an attacker to extract the full set of usernames, emails, IP addresses, and password hashes in one action.

Check If You Are Affected

If you ever had a Plex forum account, or if you have reused a password across different services, it is worth checking your exposure. HEROIC's free breach scanner checks your email against more than 400 billion breached records, including this one, so you can find out and secure any accounts that share the same password.