OwnedCore Data Breach (2013): What Was Exposed & What To Do

In August 2013, the operators of OwnedCore, a forum focused on World of Warcraft exploits, reported that more than 880,000 user accounts had been exposed following unauthorized access to the site. The breach affected a vBulletin installation and included email addresses, usernames, IP addresses, and passwords stored as salted hashes. Public records indicate that the hashing implementation was weak enough to allow many passwords to be cracked after the data appeared online.

Breaking down the breach

The incident was publicly noted on 1 August 2013. Contemporary reports stated that the forum’s database had been accessed and that records for approximately 880,000 accounts were taken. The exposed material comprised email addresses, usernames, IP addresses recorded at the time of user activity, and passwords stored as salted hashes. The hashing method used on the vBulletin platform was described as weak, permitting rapid recovery of a portion of the passwords once the data became available. No further technical details on the initial point of entry or the precise date of the intrusion have been disclosed in available records.

How a breach like this happens

Forums running older versions of bulletin-board software have historically been targeted through unpatched vulnerabilities in the application or its extensions. Attackers often obtain database credentials by exploiting web-application flaws that allow direct queries to user tables. Once inside the database, they can export entire account records, including any stored credentials. When password hashes are created with outdated or poorly implemented salting routines, the extracted data can be processed offline with modest computing resources, increasing the chance that plaintext passwords are recovered.

OwnedCore and its sector

OwnedCore operated as an online community centered on World of Warcraft exploits and related technical discussion. Sites of this type maintain user accounts to manage access to discussion threads, private messaging, and file downloads. Typical holdings include registration details, login credentials, and connection metadata such as IP addresses. A breach at such a forum is consequential because participants often reuse credentials across gaming-related sites and may have discussed or shared sensitive technical information within the community.

The information in question

The breach record identifies four categories of data: email addresses, usernames, IP addresses, and passwords. The passwords were stored as salted hashes rather than plaintext, yet the implementation was characterized as weak. No additional categories of data, such as payment information or private messages, are named in the available reporting. The exact contents of any individual record therefore remain unconfirmed beyond these four fields.

The real-world impact

Individuals whose records were included face the possibility that recovered passwords could be tested against other online services. Email addresses can be used for targeted phishing or added to distribution lists. IP addresses recorded at the time of posting may assist in correlating online activity with physical locations. For the forum itself, the incident resulted in the public exposure of its user base and prompted questions about the adequacy of its password-storage practices at the time.

If your data was in this breach

Anyone who created an account on OwnedCore around or before 2013 should treat passwords associated with that account as potentially compromised.

• Change the password on any service where the same or a similar credential was used.
• Enable multi-factor authentication on email and gaming accounts.
• Monitor login notifications and review recent account activity for signs of unauthorized access.
• Run a free exposure scan of your email address against known breach data sets to determine whether your information appears in additional incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.