1 Million Passwords Leaked From the Xbox360ISO.com Breach

HEROIC analysts identified a database breach tied to Xbox360ISO.com, a now-defunct website that hosted Xbox 360 ISO files for a community of retro gaming and console-modding users. The breach is dated to September 25, 2015, and exposed 1,023,080 accounts, including email addresses, usernames, IP addresses, salted password hashes, and plaintext passwords.

Why This Is Dangerous

Because plaintext passwords appear alongside salted hashes in this leak, some accounts are exposed in the clearest possible form: no cracking required. Combined with an email address, a plaintext password gives an attacker a ready-made login pair to try across other sites immediately. Even the salted passwords can eventually be cracked with modern hardware, especially when the underlying password was short or common.

What Was Exposed

• Email addresses
• Usernames
• Plaintext passwords
• Salted password hashes
• IP addresses

Why This Matters

Most people reuse passwords across multiple accounts, which is exactly what makes an old forum breach like this one valuable to attackers years later. A password tied to a gaming forum account from 2015 is often the same password still protecting an email, banking, or shopping account today. Attackers run leaked email and password pairs through automated tools in a technique called credential stuffing, testing them against major websites until they find a match. The included IP addresses can also help build a profile of where a user connected from at the time, adding another layer of exposure.

How Database Breaches Like This Happen

This incident is classified as a database breach: attackers gained direct access to the site's backend, typically through outdated forum software, a weak admin password, or an unpatched plugin. From there, they exported the entire user table in one pass, capturing everything the site stored about its members, including credentials and activity data. Because the source was a community forum rather than a major platform, security monitoring was likely minimal, which is part of why data like this can sit unnoticed for years before surfacing on hacking forums.

Check If You Are Affected

If you ever created an account on Xbox360ISO.com, or reused a password from that era anywhere else, it is worth checking now. HEROIC's free breach scanner searches a database of more than 400 billion breached records to tell you instantly if your email address has been exposed, and where. It takes seconds and could save you from a much bigger problem later.