Breach Disclosure: HTC Mania

In January 2020, the Spanish mobile phone forum HTC Mania suffered a data breach, likely due to exploitation of a recent high-profile vBulletin vulnerability. The incident exposed 1.5M member email addresses, usernames, IP addresses, dates of birth, salted MD5 password hashes and password histories.

Recommendations

If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

The website HTCMania[.]com was compromised by a hacker that goes by the name, DonJuji, and is being offered for sale on RaidForums.

Figure 1. RaidForums posting

One notable aspect of this breach is that the forum improperly logged users’ previously used passwords. This gives would-be attackers the ability to leverage these past passwords in credential stuffing attacks. With a list of historic passwords, attackers may be more likely to successfully compromise a victim’s other accounts if users have reused passwords across accounts.