2013 breach at Russian cybercrime forum resurfaces with millions of victims' credentials

YouHack thought protecting members' passwords with mostly unsalted MD5 hashes would do

A 2013 breach of Russian-language cybercrime forum YouHack exposed its members' login details – and millions of credentials they had posted about other victims, according to newly cataloged data.

Have I Been Pwned (HIBP) added the breach on Wednesday, recording 7.2 million unique email addresses. Around 107,000 belonged to forum members, whose exposed data included usernames, IP addresses, and mostly unsalted MD5 password hashes.

Unsalted MD5 is a poor choice for protecting passwords. It's fast to compute, allowing attackers to test guesses at speed, and identical passwords produce identical hashes. Hardly good hygiene for a hacking forum.

REG AD

You might expect members of a cybercrime forum to know better than to reuse passwords or register with an email address tied to their real identity. Expectations and reality are not always on speaking terms, as AlphaBay founder Alexandre Cazes demonstrated.

REG AD

YouHack, a longtime cybercrime forum, moved to a different domain after the 2013 breach and remains active, giving cybercrims a place to trade stolen credentials and financial data.

The data collated from that digital burglary was eventually bundled into 2024's so-called Mother of all Breaches – a 12TB, 26 billion-record mega-dump of files taken from myriad data security lapses.

Millions more

HIBP separately published its findings concerning another Russian data breach today. It said the 2023 breach of Russian bank Sberbank's loyalty program (SberSpasibo) contained records belonging to 48 million users.

The dataset included 3.3 million unique email addresses, alongside phone numbers and dates of birth. Bank card numbers were stored as unsalted SHA-1 hashes, which could let attackers test possible numbers against the leaked hashes for a match.

Reporting on the SberSpasibo breach at the time suggested the records were dated between April 2017 and February 2022, and the attack was claimed by the pro-Ukraine hacktivist outfit NLB.

NLB also claimed responsibility for an attack on Sberbank's internal systems at the same time, and later took partial credit for an attack on Alfa-Bank, Russia's largest private bank. ®