Breach Disclosure: OGusers

On May 19 2019, Brian Krebs published a story about a data breach of a popular account hijacking forum, OGusers. OGusers is a website that is well-known for their SIM swapping attacks and taking over accounts of their victims. On May 12, administrators of OGusers posted about an 'outage' of the website which resulted in loss of several months of messages. On May 16, an administrator of RaidForums uploaded the entire OGusers database for anyone to download for free on the website. The website contained 161,000 email addresses, usernames, IP addresses, private messages and salted md5 password hashes.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

The attack here is rather ironic - a forum dedicated to compromising accounts had their accounts compromised by a rival forum. Omnipotent, the administrator of RaidForums, posted the following text in their leak thread:

"Hello RaidForums Community, Today I have uploaded the OGUsers Forum Database for you to download for free, thanks for reading and enjoy!

|Notes| On the 12th of May 2019 the forum ogusers.com was breached 112,988 users were affected. I have uploaded the data from this database breach along with their website source files. Their hashing algorithm was the default salted MD5 which surprised me, anyway the website owner has acknowledged data corruption but not a breach so I guess I'm the first to tell you the truth view his statement here or if you don't want to visit their website view it here. According to his statement he didn't have any recent backups so I guess I will provide one on this thread lmfao.

Compromised data: Website activity, Usernames, Emails, IP Addresses, Passwords (Salted MD5), Source code, Website data, User private messages"