Loading story…
A breach at the parody social site Myspace93, part of the Windows93 project, exposed data from roughly 46,000 accounts, including plaintext passwords, usernames, email addresses, and IP addresses. According to breach details later cataloged by Have I Been Pwned, the intrusion originated in January 2021 when attackers abused access to a beta application to download server files, and the stolen data was subsequently leaked in June.
Reporting on the incident said trusted members of a Windows93 Discord community had been granted beta access and then used it to obtain an unencrypted credential store, while also sharing a download tool and instructions in chat and distributing additional stolen files across other platforms. After the compromise became public, Myspace93 stopped new account registrations, and co-creator Janken said social network-related services across Windows93 offshoots were shut down.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-21, Have I Been Pwned published the Windows93/Myspace93 breach entry after ingesting the dataset. The listing documented roughly 46,000 exposed accounts with plaintext passwords and related personal data.
On 2021-07-04, co-creator Janken published a note explaining that trusted Windows93 Discord members abused beta access to steal server files and credentials. He also said Myspace93 stopped new account registrations and that related social-network services across Windows93 offshoots were shut down in response.
In June 2021, the operator discovered attackers were actively abusing leaked credentials, including using the Myspace admin password to inject XSS payloads into the site. The incident prompted emergency patching and a mandatory password reset for accounts created before February 2021.
In June 2021, the compromised Myspace93 data was leaked, making the exposed account information publicly available. Reports indicate the attackers also shared tools and instructions related to downloading the files.
In January 2021, attackers used access to a beta application on the Windows93/Myspace93 parody site to download server files and obtain an unencrypted store of Myspace93 credentials. The breach affected about 46,000 accounts and exposed usernames, email addresses, IP addresses, and plaintext passwords.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BreachForums suffered repeated compromises that exposed member data across multiple iterations of the cybercrime forum. An earlier breach leaked details on about **4,000 members**, while a later incident tied to the forum's reboot reportedly spilled data on roughly **325,000 users**, underscoring the scale of exposure affecting one of the most prominent underground marketplaces. Reporting on the more recent compromise said the forum was hit through a **MyBB `0-day`** affecting unpatched software, with forum administrators claiming the intrusion was also linked to a broader law-enforcement crackdown. The incident disrupted the platform, prompted leadership changes including the emergence of a new admin, and highlighted how even criminal forums remain vulnerable to the same software flaws, operational failures, and data-security lapses that they routinely exploit in others.
Jul 12, 2026
Researchers and media reports disclosed enormous troves of exposed login data, including an unprotected 47.42 GB database containing **184,162,718** unique usernames and passwords tied to services such as Microsoft, Facebook, Google, Instagram, Snapchat, Discord, Netflix, PayPal, and government portals in 29 countries. Security researcher Jeremiah Fowler found the database on an unmanaged server with no password protection or encryption, and sample records included account types, website URLs, and plaintext passwords labeled `senha`. Fowler said multiple individuals confirmed the leaked credentials were genuine after he contacted them directly. The exposed records are believed to be linked to **infostealer malware** and broader malware-as-a-service collection operations, with subsequent reporting describing a far larger cache totaling **16 billion** credentials affecting major consumer platforms including Apple, Facebook, and Google. The disclosures raise immediate risks of credential stuffing, account takeover, phishing, fraud, and unauthorized access to corporate and government systems. Public access to the 184 million-record database was later restricted after responsible disclosure to the hosting provider, but the owner of the data remains unidentified.
Jun 29, 2026
Internet Archive confirmed a breach that exposed data tied to **31 million user accounts** after attackers displayed a malicious JavaScript pop-up on the site announcing the intrusion. According to reporting validated by security researcher Troy Hunt and others, the stolen data dated to September 2024 and included **email addresses, screen names/usernames, bcrypt password hashes, and other system data** from the organization's digital library platform. The disclosure unfolded as Internet Archive was also contending with **intermittent distributed denial-of-service attacks** that disrupted availability and a site defacement linked to a compromised JavaScript library. Founder Brewster Kahle said security upgrades were underway; hacktivist group **BlackMeta** claimed responsibility for the DDoS activity, while the actor behind the underlying data theft was not identified. The breach was later cataloged by Have I Been Pwned as affecting 31 million records.
Jun 29, 2026