Loading story…
OGUsers, a forum associated with account hijacking and SIM swapping activity, suffered separate data breaches in April 2021 and July 2022 that exposed user account information from hundreds of thousands of members. The 2021 incident affected 348,000 unique email addresses, while the 2022 breach exposed 529,000 unique email addresses, according to records added to Have I Been Pwned.
The stolen data included usernames, email addresses, IP addresses, and password hashes. In the 2021 breach, passwords were stored with either salted MD5 or Argon2, and the data was later offered for sale on a rival hacking forum. In the 2022 breach, passwords were stored as Argon2 hashes. The 2022 incident was identified as the fifth breach affecting OGUsers since December 2018, underscoring a repeated pattern of compromise at the forum.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
In July 2022, OGUsers experienced another data breach, its fifth since December 2018. The exposed dataset included usernames, email addresses, IP addresses, and Argon2-hashed passwords, affecting 529,000 unique email addresses.
After the April 2021 breach, the stolen OGUsers data was offered for sale on a rival hacking forum. This sale involved the dataset from the 2021 incident.
In April 2021, the account hijacking and SIM swapping forum OGUsers experienced a data breach. The exposed data included usernames, email addresses, IP addresses, and passwords hashed with either salted MD5 or Argon2, affecting 348,000 unique email addresses.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The cybercrime forum **Carding Mafia**, which was used for the theft and trading of stolen credit cards, suffered two separate data breaches in 2021 that together exposed records tied to nearly **600,000 member accounts**. One breach in **March 2021** affected nearly 300,000 members, while a second breach in **December 2021** exposed more than 300,000 more, showing repeated compromise of the same criminal platform within nine months. Across the two incidents, the leaked data included **email addresses, usernames, IP addresses, and passwords hashed with salted `MD5`**. Both breaches were classified as **sensitive** and were not made publicly searchable by Have I Been Pwned, but the disclosures highlight that even illicit forums can become sources of credential exposure, infrastructure intelligence, and attribution data for defenders and investigators.
Jun 29, 2026
Several organizations disclosed data breaches affecting user and customer information, with incidents spanning different industries and timeframes. The Botting Network, a now-defunct forum focused on botting, suffered a breach in August 2012 that exposed 96,000 user records, including email addresses, usernames, dates of birth, and salted MD5 password hashes. Web Hosting Talk, a vBulletin-based forum, experienced a breach in July 2016, resulting in the exposure of 515,000 user records containing usernames, email addresses, IP addresses, and salted MD5 password hashes. Both breaches were added to public breach notification services in December 2025. In a separate incident, AUTOSUR, a French vehicle inspection company, reported a breach in March 2025 that compromised over 10 million customer records, with 487,000 unique email addresses exposed alongside names, phone numbers, physical addresses, and detailed vehicle information. Additionally, Vocatura, Spagnuolo & Company, a Massachusetts-based accounting firm, disclosed a breach involving unauthorized access to a single email account, potentially exposing sensitive personal information of over 980 individuals. The exact data types affected in the Vocatura breach have not been publicly specified as of the latest disclosure.
Jul 12, 2026
BreachForums suffered repeated compromises that exposed member data across multiple iterations of the cybercrime forum. An earlier breach leaked details on about **4,000 members**, while a later incident tied to the forum's reboot reportedly spilled data on roughly **325,000 users**, underscoring the scale of exposure affecting one of the most prominent underground marketplaces. Reporting on the more recent compromise said the forum was hit through a **MyBB `0-day`** affecting unpatched software, with forum administrators claiming the intrusion was also linked to a broader law-enforcement crackdown. The incident disrupted the platform, prompted leadership changes including the emergence of a new admin, and highlighted how even criminal forums remain vulnerable to the same software flaws, operational failures, and data-security lapses that they routinely exploit in others.
Jul 12, 2026