Nulled.cr data breach: 599K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2016-05-09
In May 2016, the cracking community forum known as Nulled.cr was hacked and 599k user accounts were leaked publicly. The compromised data included email and IP addresses, weak salted MD5 password hashes and hundreds of thousands of private messages between members. Exposed data: dates of birth, email addresses, ip addresses, passwords, private messages, usernames, website activity. The breach dates from May 6, 2016; Have I Been Pwned loaded it on May 9, 2016.
What to do
- If you had a Nulled.cr account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
