Breach Disclosure: Cracked[.]TO

The cracking forum and community Cracked[.]to recently experienced a data breach. The site released a statement on their official Twitter page, as well as on the site itself. Leaked information consisted of 749,000 usernames, IP addresses, private messages and encrypted password hashes.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
Remain alert to potential spear phishing attacks through email and social media

Details

The forum administrator posted the following statement regarding the incident:

Hello Cracked.to Members,

I wish I would have never been forced to do such a thread but that's what you get for trusting the wrong people. I will take full responsibility as it was only my fault. 

Today, 27.07.2019, I got the message that an old person of my trust has forum backups that contains the database and folder files. Those backups could be valid from End of 2018 until June 2019.
Since it's not longer in my hands that the database and forum files remain private, I wanted to use this thread to give everyone a warning about what could happen.

The database has not been published yet. However there is a chance that it's going to happen, hence we forced every user to change his password. We are also resetting all database sessions within the next few hours.

Before everyone panics:

We have changed the hashing algorithm of passwords from mybb default (md5) to something more advanced a few months ago, which makes it almost impossible to decrypt your passwords.

I'm beyond sorry that this has happened, especially for the community. 

- Forum Administration

After this initial post, the breach data was posted publicly by rival forum HackForums. In response, Cracked[.]to released a follow-up statement:

A wannabe "leaking-forum" released the database backup today that contains all data from 21st of July 2019. As announced a few weeks ago all passwords are crypted with advanced hashing (no, not Argon2, get your infos right next time) and therefore pretty much useless.

I have wiped all mybb_sessions today.
There will be consequences for the forum that is responsible for distributing the backup and for the person that leaked it.

Note: your passwords are safe! You don't need to worry or panic about those! We are not using md5 hashing.

- Forum Administration