Cyber Incident Victim: A Best Web
Date:
Jul 2016
Location:
United States of America
Summary
A hacker breached multiple online forums operated by media company Penton, compromising approximately 1.4 million user credentials from platforms including Web Hosting Talk, Mac Forums, and A Best Web. The stolen data consisted of email addresses and passwords hashed with the vulnerable MD5 algorithm and salted, with attackers reportedly cracking 60% of the credentials within hours. An individual using the alias "uid0" subsequently offered the databases for sale on a dark web marketplace for 7.2 bitcoin. The breach was later publicly disclosed by a third-party data monitoring service, confirming the unauthorized access and data exfiltration from the affected sites.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On July 4, 2016, hackers breached the media company Penton, compromising databases for multiple online forums including Web Hosting Talk, Mac Forums, HotScripts.com, dbForums, and A Best Web. The attackers exfiltrated 1,442,602 user records containing email addresses, usernames, and passwords. The stolen passwords were protected using salted MD5 hashing, though this algorithm was already recognized as cryptographically weak. An individual using the alias "uid0" subsequently advertised the combined databases for sale on the dark web marketplace The Real Deal, pricing the data at 7.2 bitcoin (approximately $4,752 at the time). LeakedSource, a data breach monitoring service, independently verified the intrusion and disclosed the incident publicly on an unspecified Friday evening following the breach. The service confirmed the attack vector targeted Penton’s infrastructure, impacting all five affiliated websites simultaneously.
LeakedSource analysts reported successfully cracking approximately 60% of the stolen password hashes within two hours due to MD5’s vulnerabilities, exposing plaintext credentials for a significant portion of affected accounts. The cumulative theft impacted 1.4 million users across the compromised platforms, with no evidence suggesting financial data or additional personal information was accessed. Following verification of the breach, LeakedSource urged users of all five forums—including A Best Web—to immediately change their passwords and avoid reusing credentials across other services. The sale listing on The Real Deal remained active as of the initial disclosure date, though subsequent purchaser activity or data dissemination was not confirmed in available reports. No official statements from Penton or detailed remediation actions by the affected forums were documented in the sourced material.