GPS Underground Data Breach (2016): What Was Exposed & What To Do

In 2016 a data breach at the online forum GPS Underground exposed records for 670,000 users. The incident involved usernames, email addresses, IP addresses, dates of birth and salted MD5 password hashes. The data later appeared among other compromised vBulletin sites offered for sale. The exposure matters because the records include both account credentials and personal details that can be used to target individuals across multiple services.

Inside the incident

The breach dates to mid-2016. In early 2017 the data set was identified among a group of compromised vBulletin websites being sold online. Public records list 670,000 affected accounts containing usernames, email addresses, IP addresses, dates of birth and salted MD5 password hashes. No further technical details on the initial intrusion or the exact date the data left the site have been disclosed.

How a breach like this happens

Forums running older versions of vBulletin have frequently been targeted through unpatched software vulnerabilities. Attackers exploit these weaknesses to gain access to the underlying database, extract user tables and remove the data for later sale or use. Once obtained, the records are commonly packaged with material from other sites and traded on underground markets. The presence of salted MD5 hashes indicates the passwords were stored with a basic hashing method common at the time, which does not prevent offline cracking attempts if the hashes are obtained.

Who is GPS Underground?

GPS Underground operated an online discussion forum built on vBulletin software. Sites of this type typically maintain user accounts for registered members who discuss niche technical topics. A breach at such a forum is consequential because the combination of login credentials and personal identifiers can be reused against other accounts and services that individuals may have created with the same details.

The information in question

The records reported as exposed include usernames, email addresses, IP addresses, dates of birth and salted MD5 password hashes. No additional categories of data have been confirmed. Organisations that run discussion forums commonly store these fields to manage accounts and display activity, yet the precise scope of what was taken in this case remains limited to the fields listed above.

The real-world impact

Individuals whose records were included face the possibility that their email addresses and password hashes could be tested against other online services. Dates of birth and IP addresses add context that can support targeted account-recovery attempts or further profiling. For the organisation, the incident highlights the long-term risk that forum data retains value on secondary markets even years after the initial compromise.

If your data was in this breach

Review any accounts that still use the same email address and password combination. Change those passwords and enable multi-factor authentication where available. Monitor login notifications from services tied to the exposed email address. Readers can also run a free exposure scan of their email address against known breach data sets to check for additional appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.