The Avast Forum Breach: 359,923 Passwords Exposed. Yours Might Be One.

HEROIC analysts logged the 2014 breach of Avast's community forum, run on Simple Machines Forum software for the antivirus company Avast. Dated May 25, 2014, the forum was hacked and member records were exposed. HEROIC's database holds 359,923 of those records, containing usernames, email addresses, and password hashes protected with SHA-1.

Why the Avast Breach Is Dangerous

SHA-1 hashing is fast to compute, which is exactly what makes it weak for protecting passwords. Attackers can test billions of password guesses per second against SHA-1 hashes, so common or reused passwords in this data set are at real risk of being cracked.

What Was Exposed in the Avast Breach

• Email addresses
• Usernames
• SHA-1 password hashes

Why the Avast Breach Matters

Even security-conscious users can end up in a breach through a forum they barely use. Once a password is cracked, attackers try it against email, banking, and other accounts through credential stuffing. Because this forum is tied to a well-known antivirus brand, cracked credentials here could also be used as bait in phishing emails impersonating Avast support.

How the Avast Data Was Exposed

This is a database breach. An attacker gained access to the forum software's backend and exported the full member table in one operation, rather than compromising accounts individually. Community forums built on older platforms are a common target for this kind of attack, since a single flaw in the software can expose every member at once.

Check If You Were Affected by the Avast Breach

If you ever registered on Avast's forum, check whether your email address is part of this exposure. HEROIC's free breach scanner searches more than 400 billion leaked records, including this one, so you can see your exposure and update any reused passwords.