Identity Theft Just Got Easier Because of the Void.to Breach: 86K Exposed

HEROIC analysts uncovered renewed activity around the Void.to breach, which occured in June 2019 and exposed 86,308 forum user records. The data, pulled from a MyBB-based hacking forum based in the United States, included email addresses, usernames, password hashes, salts, and birthdates. A rival hacking group claimed responsibility, and the dump has since recieved fresh attention on underground forums and Telegram channels years after the original incident.

How Attackers Use Hashed Passwords and Birthdates Against You

Even though passwords in the Void.to breach were stored as hashed values using MD5 and bcrypt, criminals can still crack weaker MD5 hashes using automated tools. Combined with birthdates and email addresses, attackers can construct highly targeted phishing messages or reset account passwords on other platforms where victims reused the same credentials. The birthday data is partcularly dangerous because it is used as a verification answer on many account recovery forms.

What Was Exposed in the Void.to Breach

• Email Address
• Password Hash
• Username
• Salt
• Birthday

Why a Hacking Forum Breach Is Especially Dangerous

Users of hacking forums like Void.to often reuse the same credentials across many platforms, including email accounts and corporate systems. If those MD5 hashes are cracked, attackers gain access to a ready-made list of people with security knowledge, making them high-value targets. The risk of credential stuffing, account takeover, identity theft, and financial fraud is seperate from the original breach but very real, and it grows every time the data resurfaces on a new forum or marketplace.

How Database Breaches Work

A database breach happens when an attacker gains unauthorized access to the backend systems of a website or application and copies or steals the stored data. In most cases, attackers exploit unpatched software, weak passwords, or misconfigured servers. Once inside, they can export entire user tables containing emails, usernames, and hashed passwords. The stolen data is then typically posted on underground forums, sold to other criminals, or used directly in automated login attacks against other websites.

Check If Your Data Was Exposed

HEROIC's free breach scanner checks your email address against a database of over 400 billion leaked records, including data from the Void.to breach and thousands of other incidents. Find out in seconds whether your information is circulating on the dark web and take action before attackers do.