ShockGore Data Breach (2020): What Was Exposed & What To Do

In August 2020, a data breach at the ShockGore website exposed records belonging to 74,000 users. The incident was reported on 11 August 2020 and included email addresses, usernames, IP addresses, genders, unsalted SHA-1 password hashes, and private messages. The exposure of this material creates direct risks for the individuals whose details appeared in the data set. Email addresses and password hashes can be used in attempts to access other online accounts, while IP addresses and private messages add layers of personal context that are difficult to retract once released.

Breaking down the breach

The breach was reported on 11 August 2020 and affected 74,000 unique email addresses. The exposed data also included usernames, IP addresses, genders, unsalted SHA-1 password hashes, and private messages. No further details on the timing of the intrusion, the method used, or the total volume of files involved have been disclosed.

How a breach like this happens

Incidents involving online platforms often begin with the exploitation of unpatched software, weak authentication controls, or misconfigured databases that allow unauthorised access. Once inside the network, an attacker can copy user tables and associated logs without immediate detection. Data of this type is then sometimes posted on public forums or sold, after which it circulates among parties who test the password hashes against other services.

Who is ShockGore?

ShockGore operated as a website dedicated to the sharing of graphic videos and images depicting gore and animal cruelty. Organisations in this sector collect user accounts to manage uploads, comments, and private messaging. A breach at such a site is consequential because the combination of account credentials and private communications can reveal sensitive personal interests and network identifiers that users typically expect to remain confidential.

What data was at risk

The breach record lists the following data elements as exposed: email addresses, usernames, IP addresses, genders, unsalted SHA-1 password hashes, and private messages. The exact contents of the private messages are not itemised beyond the fact that they were included. Organisations of this type commonly store additional profile information and activity logs, but the precise scope of any unlisted fields remains unconfirmed.

The real-world impact

Individuals whose email addresses and unsalted password hashes were exposed face an elevated chance that the credentials will be tested against other websites. IP addresses can be used to narrow geographic location, and the release of private messages creates a permanent record of communications that users may have considered restricted. For the organisation, the incident removes trust in its ability to protect account data and may prompt users to delete accounts or avoid similar services.

Were you affected?

Anyone who created an account on ShockGore should assume their listed details may have been included. The immediate steps are to change passwords on any other sites that reuse the same credentials and to enable multi-factor authentication where available. Readers can also run a free exposure scan of their email address against known breach data sets to check for additional appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.