Cracked.to Data Breach (2019): What Was Exposed & What To Do

Inside the incident

The breach affected the Cracked.to forum, which ran on MyBB software. Public reports state that 749,000 unique email addresses were present across 321,000 forum user records and additional database tables. The disclosed data also included IP addresses, usernames, private messages and passwords stored as bcrypt hashes. A rival hacking website claimed responsibility for obtaining the data, though no independent confirmation of the method or timing of access has been published.

How a breach like this happens

Forums and similar online platforms are frequently targeted because they hold large volumes of user credentials and contact details. Attackers often exploit unpatched software, weak authentication controls or stolen administrative access to reach the underlying database. Once inside, they can copy tables containing user information without necessarily altering the site itself. In many cases the first public sign of the incident is the appearance of the data on other sites rather than any notification from the affected service.

About Cracked.to

Cracked.to operated as an online forum focused on hacking and cracking topics. Sites of this type typically require users to create accounts to access discussion threads, tools or shared resources, resulting in the collection of email addresses, usernames and passwords. Because participants often reuse credentials across multiple communities, a breach at one forum can affect accounts on unrelated services.

What was likely exposed

The reported data types include email addresses, IP addresses, usernames, private messages and passwords stored as bcrypt hashes. The exact scope of private messages and any additional fields in the database remain unconfirmed beyond the figures already stated. No further categories of information have been disclosed in public reports of the incident.

The real-world impact

Exposed email addresses and usernames can be used for targeted phishing or to link online activity to real-world identities when combined with other data. Password hashes, even when stored with bcrypt, may be tested against common passwords if users chose weak ones. IP addresses can reveal approximate locations at the time of posting. For the organisation, the incident highlights the difficulty of securing niche forums that attract both legitimate discussion and malicious interest.

What to do if you're exposed

Anyone who created an account on Cracked.to should change the password on that site and on any other service where the same password was used. Enabling two-factor authentication where available reduces the value of a leaked password. Monitoring email accounts for unexpected login attempts or messages provides an early warning of misuse. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.