XKCD Data Breach (2019): What Was Exposed & What To Do

What happened

The breach occurred on the phpBB-based discussion forum tied to XKCD. Records show that usernames, email addresses, IP addresses, and passwords hashed with the MD5 algorithm used by phpBB3 were taken from the site. No further details on the method of access, the exact date of the intrusion, or any subsequent activity by the actors have been disclosed in public reporting.

How a breach like this happens

Web forums running older bulletin-board software are frequently targeted through unpatched vulnerabilities, weak administrative credentials, or misconfigured database access. Once an attacker obtains a copy of the user table, they can extract the stored credentials and any associated contact or network information. In many cases the compromise is noticed only after the data appears on public breach repositories or is shared with researchers.

XKCD and its sector

XKCD operates a long-running webcomic and maintains an associated online forum for reader discussion. Sites of this type routinely collect account details to support threaded conversations, private messaging, and community moderation. A breach at such a forum therefore involves the same categories of personal data that appear in many other online communities.

The information in question

The records confirmed as exposed are usernames, email addresses, IP addresses, and passwords stored as MD5 hashes in the phpBB3 format. It has not been disclosed whether additional fields such as private messages, post histories, or payment information were also present in the dataset.

The real-world impact

Individuals whose records were taken face the possibility that their email addresses and usernames could be used for targeted phishing or that their passwords could be recovered if they reused the same credential elsewhere. The organisation may experience reputational effects and the administrative burden of notifying users and improving security controls. Because the passwords were stored with an older hashing method, offline cracking attempts become feasible for any reused or simple passwords.

What to do if you're exposed

Change the password on the XKCD forum account and on any other service where the same password was used. Enable two-factor authentication wherever available. Monitor email accounts for unexpected login attempts or password-reset messages. Readers can run a free exposure scan of their email address against known breach data to determine whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.