If You Reused Passwords, the RaidForums Leak Should Worry You

HEROIC analysts tracked the RaidForums database breach, which first surfaced in September 2020 and later resurfaced publicly in May 2023. The breach exposed 478,516 user records including email addresses, usernames, birthdays, Argon2 password hashes, and password salts from the now-defunct hacking forum that had itself been a hub for trading stolen data.

How a Hacking Forum's Own User Data Becomes a Credential Stuffing Weapon

RaidForums members frequently used personal or work email addresses to register on the platform. Those same emails, now paired with birthdays and Argon2 hashes, are partcularly attractive to attackers running credential stuffing campaigns against corporate VPNs, email systems, and financial platforms. The irony is that forum members who traded breach data are now themselves part of one, making their accounts accessable to the same tactics they once used.

What Was Exposed in the RaidForums Breach

• Email Address
• Username
• Birthday
• Password Hash
• Salt

Why the RaidForums Breach Is a Corporate Security Concern

Employees who used personal or work email addresses on hacking forums like RaidForums may have recieved no notice that their credentials were exposed. If those same passwords were reused on corporate systems, attackers have a direct path into enterprise networks. The breach occured years ago but continues to circulate in underground markets, meaning the risk has not diminished with time.

How Database Breaches Work

A database breach occurs when attackers gain unauthorized access to a platform's stored user records, extracting login credentials, personal details, and metadata. In the case of RaidForums, the site itself was seized by law enforcement in April 2022, and the underlying database was later distributed through rival hacking communities.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks more than 400 billion records, including the RaidForums dump and thousands of other known leaks. Search your email at HEROIC.com to find out if your credentials are in circulation on the dark web.