The Candid Board Data Breach (2015): What Was Exposed & What To Do

In September 2015, a data breach at The Candid Board exposed records associated with more than 178,000 accounts on the site’s vBulletin forum. The incident was reported on September 3, 2015, and involved the disclosure of email addresses, IP addresses, dates of birth, usernames, geographic locations, website activity, and salted passwords stored as MD5 hashes. Such incidents remain relevant today because data from older forum compromises continues to circulate in criminal markets and is reused in credential-stuffing campaigns against current services.

What happened

The breach occurred at The Candid Board, a site described as a non-consensual voyeurism forum. Attackers compromised the vBulletin installation and obtained account data for more than 178,000 users. The exposed material included email addresses, IP addresses, dates of birth, usernames, geographic locations, website activity, and passwords that had been salted and hashed with MD5. No further details on the intrusion method, exact timing of access, or subsequent use of the data have been publicly confirmed.

How a breach like this happens

Forum platforms such as vBulletin have historically been targeted through unpatched software vulnerabilities, weak administrative credentials, or compromised third-party plugins. Once initial access is obtained, attackers can extract database tables containing user records. Passwords stored with older hashing methods like unsalted or weakly salted MD5 are more susceptible to offline cracking than modern algorithms. Geographic locations and IP addresses are often logged automatically by forum software for moderation purposes, increasing the volume of data available if the database is reached.

Who is The Candid Board?

The Candid Board operated as an online forum focused on non-consensual voyeurism content. Organizations in this sector typically collect registration details to manage accounts and moderation, including contact information, device identifiers, and activity logs. A breach at such a site is consequential because the combination of personal identifiers and account credentials can be repurposed across unrelated services where users have reused passwords.

What data was at risk

• Dates of birth
• Email addresses
• Geographic locations
• IP addresses
• Passwords (salted MD5)
• Usernames
• Website activity

Why it matters

Exposed email addresses and usernames can facilitate targeted phishing or account takeover attempts on other platforms. Hashed passwords, even when salted, may be cracked over time if the hashing method is outdated, allowing reuse against additional sites. IP addresses and dates of birth add to the pool of information that can support identity verification fraud or more precise social-engineering attacks. For the organization, the incident highlighted the risks of running legacy forum software without current security controls.

If your data was in this breach

Change passwords on any accounts that reuse the exposed credentials, beginning with email and financial services. Enable multi-factor authentication wherever available. Monitor for unusual login attempts and consider using a password manager to generate unique credentials. Readers can run a free exposure scan of their email address against known breach datasets to determine whether their information appears in this or other documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.