Breach Disclosure: Nulled[.]ch

In May 2020, the hacking forum Nulled[.]ch was breached and the breached data was published on a rival hacking forum. Over 43k records were compromised which included IP and email addresses, usernames, and passwords stored as salted MD5 hashes alongside the private message history of the website's admin.

Recommendations

Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account

Details

On May 20, 2020, the administrator of RaidForums announced they breached rival hacking forum Nulled[.]ch website. RaidForums claims to have deleted Nulled's leak section and exposed 43K users' information along with the private message history of the site admin. The leaked data includes usernames, email addresses, passwords, IP addresses, date of birth, website activity, and admin private messages.

Figure 1: Screenshot of the post on a popular hacking forum

Figure 2: Screenshot from Forum announcement section of Nulled[.]ch