AbuseWith.Us Data Breach (2016): What Was Exposed & What To Do

In July 2016, AbuseWith.Us, a site that assisted users in attempts to access email and online gaming accounts, was reported to have suffered multiple data breaches affecting 1.4 million people. The exposed records included email addresses, usernames, IP addresses, and passwords stored in plain text or hashed form. Public information on the incident remains limited to the reported date, the scale of affected individuals, and the categories of data involved; further details such as the precise timing of the intrusions or the methods used have not been disclosed.

Inside the incident

The breaches came to light on 1 July 2016. Reports indicated that the site had held more than 1.3 million unique email addresses, frequently paired with usernames, IP addresses, and passwords. These passwords were described as having been collected from various sources and stored for the purpose of compromising the associated accounts. The organisation is also noted to have shared an administrator with another site, LeakedSource, and both services have since ceased operation. No additional technical specifics, such as the number of distinct intrusion events or the volume of individual files, have been made public.

How a breach like this happens

Incidents involving sites that aggregate login credentials often begin with unauthorised access to servers or databases that store user-submitted or scraped data. Once inside, an intruder can copy entire tables containing email addresses, usernames, IP logs, and password fields. When passwords are retained in plain text or in weakly hashed formats, the copied material becomes immediately usable for further attempts against other services. In many cases the initial entry point is a known software vulnerability, a misconfigured access control, or the reuse of credentials from an earlier unrelated breach. The subsequent publication or sale of the data set is a separate step that occurs after the copy has been obtained.

Who is AbuseWith.Us?

AbuseWith.Us operated as a service that provided tools and information intended to help individuals gain access to email and online gaming accounts belonging to others. Organisations of this type routinely collected large volumes of contact details, login identifiers, network addresses, and authentication strings. Because the service’s purpose centred on account compromise, the data it held was already oriented toward misuse. A breach at such a site therefore carries added weight: the records were assembled expressly for the purpose of targeting accounts rather than for routine business operations.

What data was at risk

The breach notification listed four categories of information: email addresses, IP addresses, passwords, and usernames. The passwords were reported to exist in both plain-text and hashed forms. No further breakdown of the data set, such as the proportion of plain-text versus hashed entries or the presence of any additional fields, has been released. While services of this nature commonly retain other metadata, the exact contents of the AbuseWith.Us records remain unconfirmed beyond the four named types.

The real-world impact

Individuals whose records appeared in the data set face the possibility that their email addresses and passwords could be tested against other online services. When the same password is reused across sites, exposure of even a single credential set can lead to account access elsewhere. IP addresses and usernames add context that may assist in linking records to specific devices or online identities. For the organisation itself, the incident contributed to the eventual closure of both AbuseWith.Us and the related LeakedSource service, ending their operations.

What to do if you're exposed

Anyone who used the same email and password combination on other services should change those passwords immediately and enable multi-factor authentication where available. It is also prudent to review recent login activity on important accounts and to monitor for unexpected password-reset requests. Readers can run a free exposure scan of their email address against known breach data sets to determine whether their information appears in this or other publicly reported incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.