uid0 Cyber Attack Victim

Summary

A hacker using the alias "uid0" compromised multiple online forums, including Mac Forums and Web Hosting Talk, stealing approximately 1.4 million user records containing email addresses and passwords hashed with salted MD5—a weak algorithm that allowed rapid cracking of 60% of credentials. The stolen databases were offered for sale on a dark web marketplace for 7.2 bitcoin, with the breach attributed to a security incident affecting the parent media company. Impacted users faced credential exposure risks across the affected platforms.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On July 4, 2016, hackers breached the media company Penton and compromised databases belonging to five online forums: Web Hosting Talk, Mac Forums, HotScripts.com, dbForums, and A Best Web. The attackers exfiltrated 1,442,602 user records containing email addresses, usernames, and passwords. An individual using the alias "uid0" subsequently advertised the stolen databases for sale on the dark web marketplace The Real Deal, listing them collectively for 7.2 bitcoin (approximately $4,752 at the time). The compromised credentials included password hashes protected with MD5 algorithm and salted, though security researchers from LeakedSource demonstrated these weak protections by cracking approximately 60% of the passwords within two hours of analysis. LeakedSource, a data breach notification service, publicly disclosed the incident on an unspecified Friday evening following the July 4 breach, confirming the attack vector and scope.

The breach impacted users across multiple technical communities focused on web hosting, macOS software, scripting resources, and database administration. While no forum operators issued immediate public statements according to available reports, LeakedSource's disclosure emphasized the risks of password reuse due to the high crack rate of the weakly hashed credentials. The attacker's monetization attempt through The Real Deal marketplace represented a direct financial motivation for the intrusion. Security analysts confirmed the data's authenticity by cross-referencing samples with known user information from the affected platforms. No evidence suggested further malicious activity beyond the initial data exfiltration and sale offer. The incident highlighted vulnerabilities in legacy credential storage practices despite the use of salting, given MD5's computational weaknesses enabling rapid password recovery. Users received standard guidance to change forum passwords and avoid credential reuse across other services following the disclosure.

Sources

Sources available to members: 1 source.