Nulled.ch Data Breach (2020): What Was Exposed & What To Do

In May 2020, operators of the hacking forum Nulled.ch disclosed that the site had been breached, with more than 43,000 user records later appearing on a rival forum. The published material included email addresses, usernames, IP addresses, passwords stored as salted MD5 hashes, and the private message history of the site’s administrator. The incident was reported on 20 May 2020. The event illustrates a recurring pattern in which forums that facilitate discussion of unauthorized access themselves become targets. When such platforms are compromised, the data released can extend beyond routine account details to include internal communications that were never intended for wider circulation.

Inside the incident

According to the available reporting, the breach occurred sometime before 20 May 2020. The compromised records were subsequently posted on another hacking forum rather than being held for ransom or used privately. The published dataset contained 43,000 entries that included email addresses, usernames, IP addresses, passwords hashed with salted MD5, and the private message archive belonging to the forum administrator. No further technical details about the intrusion method, the duration of unauthorized access, or the precise timeline of data exfiltration have been made public.

How a breach like this happens

Web forums that allow user registration and store credentials are frequent targets because they often run on standard software stacks and retain large volumes of account data. Attackers commonly exploit unpatched vulnerabilities in forum software, weak administrative passwords, or misconfigured database permissions to gain initial access. Once inside, they can extract user tables and any associated private content. In many cases the stolen material is then shared on competing sites to undermine the original forum’s reputation or to enable further attacks against its members.

Who is Nulled.ch?

Nulled.ch operated as an online forum focused on topics related to unauthorized access, software cracking, and related technical discussions. Like similar platforms, it maintained user accounts that recorded email addresses, usernames, IP addresses at time of login, and passwords for authentication. Because such sites also host private messaging systems, they accumulate additional personal correspondence that is not visible to ordinary members. A breach at one of these forums therefore exposes both routine login information and internal communications that participants may have considered confidential.

What was likely exposed

The reported dataset explicitly named email addresses, usernames, IP addresses, passwords stored as salted MD5 hashes, and the administrator’s private messages. No other categories of information, such as payment details or additional personal identifiers, were listed in the available reporting. The exact scope of any additional files or logs that may have been taken remains undisclosed.

The real-world impact

Individuals whose records appeared in the dataset face the possibility that their email addresses and hashed passwords could be used in credential-stuffing attacks against other services. IP addresses can assist in linking online activity to physical locations, while the release of private messages may reveal associations or discussions that users intended to keep limited. For the forum itself, the incident removed a measure of operational trust and demonstrated that even platforms built around security-conscious users remain subject to the same infrastructure risks as any other web service.

Were you affected?

Anyone who created an account on Nulled.ch should assume their email address, username, and hashed password are now in circulation. A practical first step is to change the password on any other site where the same credentials were reused and to enable multi-factor authentication where available. Readers can also submit their email address to a free exposure-checking service that searches known breach repositories to determine whether their information has appeared in this or other documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.