Our Analysts Found the Scam.com Breach Exposing 172,566 Accounts

HEROIC analysts found a 2016 data breach connected to Scam.com, an online forum where users discuss and expose scams. Ironically, the site itself was breached, exposing 172,566 accounts. The compromised records include email addresses, usernames, salt values, and password hashes protected with salted MD5.

Why This Is Dangerous

MD5 is an older hashing algorithm, and even with salting applied, it can still be cracked by attackers using modern computing power, especially against common or weak passwords. Once a password is recovered, an attacker has a working email address, username, and password combination to try on other accounts.

What Was Exposed

• Email addresses
• Usernames
• Password hashes (salted MD5)
• Salt values

Why This Matters

Scam.com's user base is made up of people actively researching and discussing scams and fraud, which makes this exposure especially useful to attackers running phishing or social engineering campaigns against a group that may assume it already knows how to spot a scam. Combined with the risk of password reuse, anyone whose data appeared in this breach faces a higher chance of targeted phishing, account takeover, or identity theft.

How This Database Breach Happened

This incident is classified as a database breach, meaning attackers gained direct access to Scam.com's user database rather than harvesting credentials one at a time. Forums like this are common targets for attackers looking for outdated software or unpatched vulnerabilities. Once inside, an attacker can copy the entire user table in one move, which is how a single incident can expose well over 170,000 accounts at once.

Check If You Are Affected

If you ever registered on Scam.com, especially around 2016, it is worth checking whether your data is part of this exposure. HEROIC's free breach scanner checks a database of more than 400 billion leaked records, so you can see instantly if your email address turns up and update any passwords you may still be reusing.