Loading story…
Flash Flash Revolution, a music-based rhythm game, suffered two major account compromises that together exposed data from roughly 3.7 million records. In the February 2016 incident, attackers breached the site's vBulletin forum and exposed about 1.8 million accounts, including email addresses, IP addresses, and salted MD5 password hashes.
A separate breach in July 2019 affected nearly 1.9 million members and was disclosed as distinct from the earlier compromise. The later incident exposed email addresses, IP addresses, usernames, dates of birth, and salted MD5 password hashes, extending the scope of personal data tied to the platform and creating renewed credential and privacy risks for affected users.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
In July 2019, Flash Flash Revolution suffered a separate data breach affecting nearly 1.9 million members. Exposed data included email addresses, IP addresses, usernames, dates of birth, and salted MD5 password hashes.
In February 2016, Flash Flash Revolution's vBulletin forum was hacked, exposing approximately 1.8 million accounts. Compromised data included email addresses, IP addresses, and salted MD5 password hashes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BreachForums suffered repeated compromises that exposed member data across multiple iterations of the cybercrime forum. An earlier breach leaked details on about **4,000 members**, while a later incident tied to the forum's reboot reportedly spilled data on roughly **325,000 users**, underscoring the scale of exposure affecting one of the most prominent underground marketplaces. Reporting on the more recent compromise said the forum was hit through a **MyBB `0-day`** affecting unpatched software, with forum administrators claiming the intrusion was also linked to a broader law-enforcement crackdown. The incident disrupted the platform, prompted leadership changes including the emergence of a new admin, and highlighted how even criminal forums remain vulnerable to the same software flaws, operational failures, and data-security lapses that they routinely exploit in others.
Jul 12, 2026
SoundCloud confirmed unauthorized access to an internal/ancillary service dashboard that enabled attackers to correlate **hidden email addresses** with information already visible on public SoundCloud profiles, impacting roughly **29.8 million accounts** (about **20%** of its user base). Exposed data was primarily **email addresses** plus public-profile metadata (e.g., usernames/display names, avatars, follower/following counts, and other profile statistics); SoundCloud stated **no passwords or financial data** were accessed. Users also reported service disruptions around the time of the incident, including access issues such as `403 Forbidden` errors (notably when connecting via VPN), consistent with post-incident security changes and response actions. Reporting attributed the intrusion and subsequent extortion attempt to the **ShinyHunters** group, with SoundCloud later acknowledging the actor made demands and used harassment tactics such as **email flooding**. The stolen dataset was subsequently leaked and then added to *Have I Been Pwned* for exposure checking, increasing downstream risk of targeted phishing and account-takeover attempts via credential stuffing on other services where users may have reused emails as identifiers. Separate contemporaneous claims by ShinyHunters against other companies (e.g., Panera Bread, CarMax, Edmunds) were reported but are distinct from the confirmed SoundCloud incident and include different alleged access vectors (e.g., stolen SSO codes).
Jun 29, 2026
Club Penguin Rewritten, an independent recreation of Disney's Club Penguin, suffered two major data breaches that exposed account data from its user base. The first incident, in January 2018, affected nearly **1.7 million** unique email addresses, along with usernames, IP addresses, and passwords stored as `bcrypt` hashes; the site said at the time that it was aware of the breach and had contacted affected users. A second breach in July 2019 exposed another **4 million** unique email addresses and included the same categories of data: email addresses, usernames, IP addresses, and `bcrypt`-hashed passwords. Combined, the incidents left roughly **5.7 million** accounts exposed across the two compromises, underscoring repeated security failures at a gaming platform aimed at children and young users.
Jun 29, 2026