Evermotion Data Breach (2015): What Was Exposed & What To Do
SourceBreach data provided in part by Have I Been Pwned, used under CC BY 4.0.
The Evermotion Data Breach (2015) (reported May 7, 2015) exposed Dates of birth, Email addresses, Passwords and Usernames belonging to roughly 436K people. If you have an account with them, your information may now be circulating on the open web and with data brokers. Here’s exactly what happened, how to check if you were affected, and what to do next.
What happened
The breach was reported on 7 May 2015. Public records indicate that 436,000 unique user records were obtained from Evermotion’s vBulletin-based forum. The exposed information consisted of email addresses, usernames, dates of birth and salted MD5 hashes of passwords. No further details on the method of access or the precise date of the intrusion have been disclosed in available reports.
How a breach like this happens
Forum platforms such as vBulletin have historically been targeted through unpatched software vulnerabilities, weak administrative credentials or compromised third-party components. Once an attacker obtains database access, they can extract user tables that store login details and personal identifiers. Salted password hashes slow down automated cracking attempts but do not prevent exposure of the data itself when the database is copied.
About Evermotion
Evermotion operates a website focused on 3D modelling resources, primarily serving artists, designers and visualisation professionals. Sites of this type maintain user accounts to manage downloads, forum participation and purchases. A breach at such a service can affect individuals who registered years earlier and may no longer actively monitor the account.
What data was at risk
The records confirmed as exposed contained email addresses, usernames, dates of birth and salted MD5 hashes of passwords. No additional categories such as payment information or full names have been reported in connection with this incident. The exact scope of any other fields that may have been present in the database remains unconfirmed.
The real-world impact
Individuals whose records were included face the possibility that their email addresses and password hashes could be used in attempts to access other online accounts where the same credentials were reused. Dates of birth can assist in identity-verification processes or targeted phishing. For the organisation, the incident highlighted the long-term retention of user data from older forum software without corresponding public disclosure at the time.
If your data was in this breach
Change the password on any Evermotion account and on any other service where the same password or a close variation was used. Enable multi-factor authentication where available. Review account activity for signs of unauthorised access. Readers can run a free exposure scan of their email address against known breach data to check for appearances in this or other incidents.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
Trillian Data Breach (2015)QuinStreet Data Breach (2015)Aternos Data Breach (2015)Nihonomaru Data Breach (2015)Latest breaches
Read GalaxyWarden’s full analysis of the Evermotion Data Breach (2015) →
Verified breach. Breach data provided in part by Have I Been Pwned, used under CC BY 4.0.
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.