Cyber Incident Victim: Scott Herman Fitness
Date:
Mar 2015
Location:
United States of America
Summary
A bodybuilding and strength training website operated by athlete Scott Herman suffered a data breach involving hacker Sinister, resulting in the public exposure of 54,096 user records. Compromised information included usernames, email addresses, hashed passwords, full physical addresses, phone numbers, payment methods, and partial credit card details for affected accounts. The attack caused significant operational disruption, with the site experiencing repeated downtime potentially linked to credential-testing attempts using the stolen data.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 2, 2015, cybersecurity monitoring service BreachAlarm identified a data breach impacting MuscularStrength.com, a bodybuilding and strength training website operated by athlete Scott Herman. The breach involved the public release of 54,096 user records by a hacker using the alias "Sinister." Compromised data included usernames, email addresses, hashed passwords, full street addresses (city, state, ZIP code, country), payment method information, and phone numbers. For accounts where credit cards were used as payment methods, the leaked records additionally contained card expiration dates and the last four digits of card numbers. The breach affected the site's community forum and online store infrastructure, though the specific intrusion vector used by the attacker wasn't disclosed in available reporting.
Following the breach, MuscularStrength.com experienced significant operational disruptions, with the website frequently going offline. Security analysts attributed these outages to potential credential-stuffing attacks where threat actors attempted to validate the stolen login credentials through automated access attempts. The public disclosure explicitly advised all registered users to immediately change their passwords using complex combinations of numbers, uppercase and lowercase letters, and symbols. Users were further cautioned against password reuse across multiple services and encouraged to adopt password managers for credential generation and storage. No statements from MuscularStrength.com's operators regarding containment measures, forensic investigations, or notifications to regulatory bodies were documented in the analyzed source material at the time of reporting.