Breach notification site Have I Been Pwned catalogs millions of leaked records from hacking forum YouHack

Data breach tracking service Have I Been Pwned added a database containing roughly 7.2 million unique email addresses originating from a May 2013 breach of the Russian-language cybercrime forum YouHack. The uploaded collection includes millions of email and password combinations stolen from outside victims that forum members had shared, alongside credentials for around 107,000 forum members themselves. [1][2]

For the forum members, the exposed information contains usernames, IP addresses, and password hashes stored with outdated MD5 encryption that Have I Been Pwned noted was mostly unsalted. Because unsalted MD5 hashes lack unique randomized values, security analysts warn that attackers can rapidly decipher them with standard tools and precomputed lookup tables to carry out credential-stuffing attacks against users who reuse passwords. [1][2]

The files had previously appeared on the clear web as part of the 2024 "Mother of All Breaches" collection, which compiled 26 billion records across 12 terabytes. Have I Been Pwned also disclosed records from a 2023 breach of Sberbank's loyalty program, SberSpasibo, which exposed 48 million user records, including 3.3 million unique email addresses, birth dates, phone numbers, and bank card numbers hashed with unsalted SHA-1. [1][2]