The UFC Fight Club Breach Has More Records Than the Population of Reno

HEROIC analysts recieved and processed a fresh signal on the UFC Fight Club database breach, originally dating back to November 2017. At that time, attackers accessed the forums at forums.ufcfightclub.com and walked away with 239,283 user records. That is more people than live in the entire city of Reno, Nevada. The exposed data included email addresses, usernames, IP addresses, and password hashes stored using an outdated MD5 hashing method with a salt.

Why Hashed Passwords and Usernames Are Still Dangerous

Many people assume that hashed passwords mean their credentials are safe. That is not quite right. MD5, even with a salt, is partcularly weak by today's standards. Attackers use automated cracking tools that can test billions of combinations per second, meaning a large portion of these hashed passwords can be reversed into plain text in a matter of hours. Add a username and email address to the mix, and an attacker has everything needed to attempt logins across dozens of other websites.

What Was Exposed in the UFC Fight Club Breach

• Email Address
• Username
• IP Address
• Password Hash

Why This Breach Still Matters Years Later

Breaches from 2017 do not just disappear. Credential stuffing tools make it easy for criminals to take an old list of emails and cracked passwords and automatically try them against banking sites, email providers, and workplace login pages. If someone used the same password on the UFC Fight Club forums that they use anywhere else today, that account is at risk. IP addresses also help attackers narrow down where a target lives or works, adding another layer of risk that is often beleived to be harmless.

How a Database Breach Works

A database breach happens when an attacker finds a vulnerability in a website or its underlying software and gains unauthorized access to the database where user information is stored. This can happen through weak passwords on admin accounts, unpatched software, or SQL injection attacks where malicious commands are slipped into a site's input fields. Once inside, the attacker copies the data and often shares or sells it on underground forums.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches across more than 400 billion records to tell you instantly whether your email address appears in known data breaches, including the UFC Fight Club incident. Run a free search at HEROIC.com and find out if your credentials are already in the wrong hands.