Old Hacking Forum Data Resurfaces: 7.2 Million Emails Leaked

Data from a 2013 breach of the Russian-language cybercrime forum YouHack has re-emerged on the clear web, with approximately 7.2 million email addresses and password pairs now publicly accessible. The exposed archive, recently added to the Have I Been Pwned? (HIBP) service, also contains 107,000 forum members' details, including usernames, IP addresses, and unsalted MD5 password hashes.

While user IP addresses and usernames from a decade ago may hold limited value, the passwords are a significant concern. Many cybercriminals, like other users, reuse passwords across different services. The use of outdated and unsalted MD5 hashes makes these passwords highly susceptible to cracking by threat actors. This enables them to gain access to other accounts where the same credentials might have been reused.

This is not the first time YouHack data has surfaced; similar information was part of the massive "Mother of All Breaches" leak in 2024. The current resurfacing occurs alongside reports of another Russian data breach, involving Sberbank's loyalty program, which exposed records of 48 million users, including partial payment details. The timing of these leaks may be influenced by ongoing cyber warfare between Russia and Ukraine, a phenomenon observed since the full-scale invasion began.