Breach Disclosure: Suba Games

Breach Disclosure: Suba Games

In June, 2016, an attacker exploited a vulnerability in web forum software vBulletin to compromise several web forums. One of those forums, Suba Games, has recently had their data resurface in underground criminal forums. The data includes email addresses and cleartext credentials. Over 6.1 million unique records were included in the breached database.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

The breach is associated with a compromise that involved 25 web forums and was originally reported in June 2016, and credited to a threat actor using the handle "Cfnt". The breach data was originally listed in an online auction in March 2017, and the data for SubaGames has resurfaced again.

The original data was orginally comprised of email addresses, usernames, passwords, forum IDs, security question data, IP address, and data of birth. The usernames and passwords were stored as salted MD5 hashes, but had been cracked. The auction listed 6,702,695 registered users and 3,607,390 accounts.