Cyber Incident Victim: HardwareZone
Date:
Sep 2017
Location:
Singapore
Summary
The HardwareZone Forum experienced a security breach compromising approximately 685,000 user profiles. A suspicious post prompted an investigation, revealing that a senior moderator’s account had been hacked by an unidentified attacker, enabling unauthorized access to user data for several months. The forum’s owner confirmed the incident, attributing the breach to the compromised moderator credentials used to infiltrate the system.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The HardwareZone (HWZ) Forum security breach was discovered on or around February 18, 2018, when administrators identified a suspicious post on the platform. This anomaly triggered an immediate investigation by HWZ's owner, SPH Magazines, to determine whether unauthorized access had occurred. Forensic analysis revealed that the breach originated from the compromised account of a senior forum moderator, which had been illicitly accessed by an unidentified threat actor. The attacker leveraged this privileged account to systematically access user profile data over a five-month period starting in September 2017. SPH Magazines publicly disclosed the incident on February 20, 2018, confirming approximately 685,000 user profiles were affected by the unauthorized access. The company initiated password resets for impacted accounts as a containment measure following the discovery.
Investigators determined the attacker maintained persistent access through the moderator account from September 2017 until detection in February 2018. The prolonged access period allowed extensive retrieval of user profile information, though the specific data elements compromised were not detailed in public disclosures. SPH Magazines conducted internal security reviews following the breach but did not publicly disclose technical details about the attack vector used to compromise the moderator account. The incident represented one of Singapore's larger data breaches at the time based on affected user count. No evidence suggested financial data or password compromises beyond the need for preventive credential resets. The company's disclosure emphasized their proactive detection through forum monitoring rather than external reports.