Your Data May Be Exposed: The CannabisForum Leak Hit 193,654 Users

HEROIC analysts have recorded a database breach affecting CannabisForum, the vBulletin-based community for the marijuana site cannabis.com, dated February 4, 2014. The incident exposed 193,654 records. According to the incident record, the leak also included nearly 10,000 private messages exchanged between forum members, though no public attribution for the attack has ever been made. The exposed data includes email addresses, usernames, and passwords in vBulletin hash format.

Why This Breach Carries Extra Weight

This is not a typical credential leak. Because cannabis.com serves a community built around a topic that remains legally sensitive in many places, the exposed private messages could reveal details users never intended to make public, alongside the usual risk of cracked login credentials. That combination of personal exposure and account compromise makes this leak more consequential than its size alone suggests.

What Was Exposed in the CannabisForum Breach

• Email addresses
• Usernames
• Passwords hashed in vBulletin format
• Private messages between forum members

Why This Matters

Once vBulletin's password hashes are cracked, which is straightforward with modern hardware, an attacker has a working email and password pair to try against other accounts through credential stuffing. If you reused your CannabisForum password anywhere else, that account is at risk of takeover. The exposed private messages add a second layer of risk: personal conversations can be used for targeted phishing, blackmail, or simply unwanted exposure of sensitive personal details.

How a vBulletin Forum Breach Happens

This incident is classified as a database breach, meaning attackers accessed the site's backend directly rather than targeting individual users. Forums running vBulletin were a common target during this period, typically compromised through unpatched software vulnerabilities or a stolen administrator login, which let an attacker export the entire user database, including private message archives, in one operation.

Check If You Are Affected

If you ever had an account on CannabisForum or a similar community site, it is worth finding out whether your information was exposed. HEROIC's free breach scanner checks your email against more than 400 billion breached records and shows you instantly what has surfaced.