Ubisoft Forum

We've been tracking the increasing frequency of forum database breaches appearing on dark web marketplaces, often several years after the initial incident. These dumps are rarely "newsworthy" in the traditional sense, but they represent a persistent risk for credential stuffing and account takeover. What caught our attention with the recent Ubisoft Forum breach wasn't the novelty, but the completeness of the data and its continued availability on multiple platforms. The information is still potent for attackers targeting gamers and Ubisoft accounts, even years after the original compromise.

Ubisoft Forum Data Breach: 1.4M User Records Resurface

A database dump from a Ubisoft Forum breach has resurfaced and is actively circulating within various online communities. The breach, which originally occurred in 2013, exposed a significant amount of user data. While Ubisoft addressed the breach at the time, the database continues to pose a risk as it is now readily available to malicious actors. This highlights the long tail of security incidents and the enduring value of compromised data for attackers.

The breach was initially discovered shortly after the compromise in 2013, with Ubisoft notifying users and forcing password resets. Our recent monitoring detected the full database being offered on multiple Telegram channels and dark web forums. The data's reappearance suggests it is being actively traded and used in credential stuffing attacks against Ubisoft accounts and potentially other online services where users may have reused passwords. The completeness of the data, including usernames, email addresses, and salted passwords, makes it particularly valuable.

This incident matters to enterprises because it exemplifies the persistent risk associated with legacy data. Even breaches that occurred years ago can resurface and be weaponized. Many users reuse passwords across multiple platforms, making old breaches a valuable resource for attackers seeking to compromise accounts on more valuable services. The Ubisoft breach is also tied to broader threat themes, specifically the aggregation and trading of breached databases on Telegram and dark web marketplaces, which facilitates the automation of credential stuffing attacks.

• Total records exposed: Approximately 1.4 million
• Types of data included: Usernames, email addresses, salted passwords, IP addresses
• Sensitive content types: Potentially security questions and answers (hashed)
• Source structure: SQL database dump
• Leak location(s): Telegram channels, various dark web forums, likely Breach Forums
• Date of first appearance: Original breach in 2013, recent resurfacing in late 2023/early 2024

External Context & Supporting Evidence

The original 2013 breach was widely reported by news outlets at the time. For example, TechRadar covered the incident, noting that usernames, email addresses, and encrypted passwords were compromised. Ubisoft issued a statement confirming the breach and advising users to change their passwords. However, the current circulation of the database indicates that the risk remains relevant.

Discussions on forums indicate that the leaked database is being actively used for credential stuffing. One Telegram post claimed the files were "freshly updated and ready for cracking." While we cannot verify the claim of "freshly updated," the continued availability and chatter around the database suggests ongoing malicious activity.