Social Engineered Data Breach (2019): What Was Exposed & What To Do

In June 2019, the website Social Engineered experienced a data breach that exposed records from its MyBB forum. The incident affected 89,000 unique email addresses linked to roughly 55,000 users, along with usernames, IP addresses, private messages, and passwords stored as salted MD5 hashes. The data appeared on a rival forum and was reported on June 13, 2019. The breach is significant because it involved a site centered on social engineering topics, where participants often discuss sensitive techniques and maintain accounts under varying levels of anonymity.

What happened

The breach occurred on the Social Engineered forum, which ran on the MyBB platform. It resulted in the disclosure of 89,000 unique email addresses distributed across 55,000 forum users and additional database tables. The published material also contained usernames, IP addresses, private messages, and passwords held as salted MD5 hashes.

Public records do not specify the precise method of access or the exact date the data were first obtained. The material surfaced on another forum before the June 13, 2019 reporting date.

How a breach like this happens

Forums that rely on older or unpatched bulletin-board software can be accessed through vulnerabilities in the platform itself or through compromised administrative credentials. Once inside the database, an attacker can extract user tables that contain email addresses, hashed passwords, and stored messages.

Passwords protected only by salted MD5 remain susceptible to offline cracking if the salt values and hash lists become available. Private messages and IP logs add further detail that can link accounts across services.

Social Engineered and its sector

Social Engineered operated as an online discussion board focused on the art of human hacking, a field that examines social engineering methods used in security testing and, at times, in unauthorized access. Sites of this kind attract members who exchange technical information, case studies, and tools related to influence techniques and defensive practices.

Organizations in this sector routinely store account credentials, communication histories, and connection metadata to support user interaction. A breach at such a site can reveal both personal identifiers and the substance of conversations that participants may have considered private.

The information in question

The disclosed records included email addresses, usernames, IP addresses, private messages, and passwords stored as salted MD5 hashes. These categories were confirmed in the published dataset.

Further details about the full contents of the database or any additional fields that may have been present have not been publicly confirmed beyond the reported items.

The real-world impact

Individuals whose information appeared in the dataset face the possibility that their email addresses and usernames could be used for targeted phishing or account takeover attempts on other platforms where the same credentials were reused. Hashed passwords may be cracked over time, increasing that risk.

Private messages could expose personal or professional details that participants shared within the community. The organization itself may encounter reduced user trust and the administrative burden of responding to the incident.

What to do if you're exposed

Anyone who used the Social Engineered forum should change the password associated with that account and any other service where the same password was used. Enabling multi-factor authentication on linked accounts reduces the chance of unauthorized access even if a hashed password is later cracked.

Users can run a free exposure scan of their email address against known breach data to determine whether their information from this or other incidents has appeared in public listings. Monitoring incoming email for unusual activity provides an additional practical step.

AICompiled with AI assistance from public sources and published under our editorial standards.