The database of the Russian-language cybercrime forum YouHack, which was hacked back in 2013, has again drawn attention after it was officially added to the Have I Been Pwned (HIBP) platform. The incident once again demonstrated an ironic reality: even members of hacker forums neglect digital hygiene.
An analysis of the published data revealed 7.2 million unique email addresses, The Register reports. Of these, about 107,000 belonged directly to forum participants. Their usernames, IP addresses, and passwords, protected mostly by unsalted MD5 hashes, were exposed in the public domain.
Unsalted MD5 is a bad choice for password protection. It is computed too quickly, which allows attackers to instantly guess combinations, and identical passwords create identical hashes. This can hardly be called good digital hygiene for a hacker forum.
One might expect that participants of a cybercrime forum would be knowledgeable enough not to reuse the same passwords and not to register using an email address linked to their real identity. However, expectations and reality do not always align, as was clearly demonstrated at one time by Alexandre Cazes — the founder of AlphaBay, which at the time of its shutdown in 2017 was the largest marketplace on the darknet (many times exceeding the scale of the famous Silk Road).
Later, these data became part of a massive 2024 mega-dump known as the "Mother of All Breaches" (12 TB, 26 billion records). After the 2013 incident, the forum itself changed its domain and continues to operate.