Scam.com

We’ve been tracking a steady stream of older forum breaches resurfacing in various Telegram channels lately, often repackaged as "new" leaks to attract buyers. While the individual record counts are usually low, the cumulative risk is significant, especially when credentials overlap with other services. What really struck us with the **Scam.com** breach wasn't its size, but the target. A forum dedicated to discussing scams, ironically, became a victim itself, potentially exposing its users to further exploitation. The data had been circulating quietly for years, but the recent uptick in its availability prompted a closer look.

The Irony of Scam.com: 172k Users Exposed in Forum Breach

In **January 2016**, the online forum **Scam.com**, a platform for discussing and exposing scams, suffered a significant data breach. The breach exposed over **360,000 records**, containing approximately **172,566 unique email addresses**, usernames, and password hashes. The incident initially flew under the radar, but its resurgence in dark web channels caught our attention due to the sensitive nature of the forum's user base and the potential for targeted attacks.

The breach was discovered after the database appeared on several dark web forums and Telegram channels known for trading compromised data. While the exact method of the breach remains unclear, the leaked data suggests a direct database compromise. The presence of **MD5 hashed and salted passwords** indicates a degree of security awareness, but the age of the algorithm and potential for rainbow table attacks still poses a risk. The timing of the leak also coincides with a period of increased forum compromises, suggesting a broader trend of targeting online communities.

The significance of this breach lies in the potential for targeted phishing and social engineering attacks against the exposed users. Individuals who frequented a forum dedicated to discussing scams are likely to be more vulnerable to sophisticated scams themselves, making this data particularly valuable to malicious actors. The re-emergence of this data highlights the long-term risk associated with older breaches and the importance of continuous monitoring for compromised credentials.

• Total records exposed: 360,000+
• Unique email addresses: 172,566
• Types of data included: Email addresses, usernames, password hashes (MD5 salted), salts
• Sensitive content types: Potentially sensitive discussions related to scams and fraud
• Source structure: Database export
• Leak location(s): Dark web forums, Telegram channels
• Date of first appearance: January 1, 2016

External Context & Supporting Evidence

While the Scam.com breach itself didn't garner widespread media attention, the trend of forum breaches is well-documented. Security researcher **Troy Hunt's Have I Been Pwned?** database includes Scam.com, confirming the breach and allowing users to check if their accounts were compromised. The use of MD5 hashing, while common at the time, is now considered weak and has been the subject of numerous security advisories. The re-emergence of older breaches like this underscores the findings in Verizon's Data Breach Investigations Report, which consistently highlights the long tail of data breaches and the persistence of compromised credentials. Discussions on Reddit's r/privacy and r/security often highlight the risks associated with outdated hashing algorithms and the need for proactive password management.