Runescape Boards

We're seeing a troubling resurgence of older forum breaches, likely due to the increasing value of historical user data for targeted advertising and credential stuffing attacks. Our team flagged this particular incident when a massive database dump from **RuneScape Boards**, a popular forum dedicated to the online role-playing game *RuneScape*, began circulating on several prominent dark web marketplaces. What really struck us wasn't the size of the leak – though substantial – but the age of the data. This wasn't a recent compromise; it was a re-emergence of a breach from over a decade ago, now being actively traded and exploited. The implications for users, especially those who may have reused passwords across multiple platforms, are significant.

### The Decade-Old *RuneScape* Boards Breach Resurfaces, Fueling Credential Stuffing

A database breach impacting the **RuneScape Boards** forum, dating back to **2013**, has resurfaced on multiple dark web forums and Telegram channels. The data, initially compromised over ten years ago, contains a wealth of information on forum users, including usernames, email addresses, and, critically, salted MD5 password hashes. The re-emergence of this data is concerning for several reasons. First, many users may have used the same email addresses and passwords on other platforms, making them vulnerable to credential stuffing attacks. Second, while the passwords are hashed, MD5 is considered a weak hashing algorithm by today's standards, making them susceptible to cracking with modern tools. The renewed interest in this older data highlights the persistent threat posed by legacy breaches. The data's reappearance suggests an active market for historical user information, likely driven by the increasing sophistication of automated attack tools and the growing value of targeted advertising profiles.

**Breach Stats:**

* **Total records exposed:** Approximately **5.5 million** user accounts.
* **Types of data included:** Usernames, email addresses, salted MD5 password hashes, IP addresses, and forum activity data (posts, threads, etc.).
* **Sensitive content types:** Potentially PII (if users included real names or personal information in their profiles), email addresses.
* **Source structure:** SQL database dump.
* **Leak location(s):** Breach Forums, Telegram channels specializing in leaked databases, and various dark web marketplaces.

### External Context & Supporting Evidence

While the original breach in **2013** was widely reported in gaming news outlets at the time, the re-emergence of the data and its implications for current security practices have received less attention. A thread on **Breach Forums** advertised the database with the title "RuneScape Boards DB - 5.5M Users" and claimed the data was "freshly cracked" despite being a decade old. Our analysis suggests that this claim of "freshly cracked" passwords likely refers to a renewed effort to crack the MD5 hashes, rather than a new breach. Security researcher **Troy Hunt** added the *RuneScape* Boards data to Have I Been Pwned? in **2016** after the initial breach, further confirming the data's existence and widespread availability. This re-emergence underscores the long tail of data breaches and the ongoing risk they pose to individuals and organizations.