MrExcel Data Breach (2016): What Was Exposed & What To Do

In December 2016, the forum for the MrExcel website suffered a data breach that exposed information tied to more than 366,000 accounts. The incident involved the vBulletin forum platform and resulted in the release of email addresses, IP addresses, dates of birth, and salted passwords stored as MD5 hashes. The owner later submitted the data to Have I Been Pwned for public checking. Such incidents remain relevant because online discussion platforms continue to hold large volumes of user account data that can be targeted through software vulnerabilities or weak configurations.

Inside the incident

The breach was reported on December 5, 2016. It affected the MrExcel forum and involved the exposure of records from 366,000 accounts. The compromised data included email addresses, IP addresses, dates of birth, and salted passwords hashed with MD5. Additional fields listed in the disclosure were usernames, social connections, and website activity logs. No further details on the precise intrusion method, duration of access, or any external claims of responsibility were included in the available reporting. The site owner self-submitted the dataset after the event.

How a breach like this happens

Forum platforms running older versions of software such as vBulletin have historically been targeted because they store user data in accessible database tables. Attackers often look for unpatched vulnerabilities that allow direct database extraction or credential theft. Once inside, they can copy account records that include login details and personal identifiers. The use of MD5 hashing, even when salted, reflects an older standard that later became easier to process offline. Public disclosure of such datasets sometimes occurs when the extracted material is shared on data-aggregation sites.

About MrExcel

MrExcel operates as a resource site focused on Microsoft Excel tips, solutions, and user support. Its forum allows registered visitors to post questions, share files, and maintain profiles that include basic account information. Organizations in this sector routinely collect usernames, email addresses, and activity logs to manage discussions and provide personalized features. A breach at such a site is consequential because the stored data can be combined with records from other services to build more complete profiles of individuals who participate in technical communities.

What was likely exposed

The reported dataset named dates of birth, email addresses, IP addresses, passwords, social connections, usernames, and website activity as exposed elements. Passwords were stored as salted MD5 hashes. No information was provided on whether additional fields such as full names, payment details, or private messages were present in the forum database. The exact scope of every record therefore remains unconfirmed beyond the categories listed in the disclosure.

The real-world impact

Individuals whose records appeared in the dataset may encounter attempts to access their MrExcel accounts or any other services where the same email and password combination was reused. MD5-hashed passwords increase the chance that offline cracking could succeed over time. IP addresses and dates of birth can contribute to more targeted phishing or account-recovery abuse. For the organization, the incident required notification steps and prompted the owner to submit the data to a public breach-tracking service, which can affect user trust in the forum’s security practices.

What to do if you're exposed

Anyone who used the MrExcel forum should change the password on that account and on any other site where the same credentials were reused. Enabling multi-factor authentication where available adds a further layer of protection. Users can also review recent login activity on linked email accounts. A free exposure scan of an email address against known breach datasets can indicate whether the address has appeared in this or other documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.