Breach Disclosure: Planet Calypso

After yet another exploitation of the vBulletin RCE vulnerability, CVE-2019-16759, the forum of gaming site Planet Calypso has been breached. This resulted in exposed usernames, email and IP addresses, and salted MD5 hashed passwords for 64,000 site users.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

This data breach dump was offered for sale on RaidForums beginning in September 2019, after an initial breach in July 2019.

Figure 1. Sales ad for this database dump on RaidForums

Given that this vBulletin vulnerability is so often exploited, ZeroFOX urges forum administrators to update vBulletin as soon as possible. The CVE being exploited to breach forums such as this one is fixed in version 5.5.5. Versions 5.0.0 - 5.5.4 remain vulnerable.