pcTattletale
May 25, 2024
•[ hack, sqlinjection, technology ]
In May 2024, the spyware service pcTattletale suffered a data breach that defaced the website and posted tens of gigabytes of data to the homepage, allegedly due to pcTattletale not responding to a previous security vulnerability report. The breach exposed data including membership records, infected PC names, captured messages and extensive logs of IP addresses and device information.
Yahoo
July 11, 2012
•[ hack, sqlinjection, technology ]
In July 2012, Yahoo! had their online publishing service "Voices" compromised via a SQL injection attack. The breach resulted in the disclosure of nearly half a million usernames and passwords stored in plain text. The breach showed that of the compromised accounts, a staggering 59% of people who also had accounts in the Sony breach reused their passwords across both services.
PPCGeeks
August 19, 2016
•[ hack, sqlinjection, technology ]
In August 2016, the pocket PC fan site forum PPCGeeks suffered a data breach that exposed over 490k records. The breach of the vBulletin forum exposed email and IP addresses, usernames, dates of birth and passwords stored as salted MD5 hashes. The data was provided to HIBP by a source who requested it be attributed to "fall1984@protonmail.com".
Spirol
February 22, 2014
•[ hack, sqlinjection, manufacturing ]
In February 2014, Connecticut based Spirol Fastening Solutions suffered a data breach that exposed over 70,000 customer records. The attack was allegedly mounted by exploiting a SQL injection vulnerability which yielded data from Spirols CRM system ranging from customers names, companies, contact information and over 55,000 unique email addresses.
Epic Games
August 11, 2016
•[ hack, sqlinjection, technology ]
In August 2016, the Epic Games forum suffered a data breach, allegedly due to a SQL injection vulnerability in vBulletin. The attack resulted in the exposure of 252k accounts including usernames, email addresses and salted MD5 hashes of passwords.
Black Hat World
June 23, 2014
•[ hack, sqlinjection, technology ]
In June 2014, the search engine optimisation forum Black Hat World had three quarters of a million accounts breached from their system. The breach included various personally identifiable attributes which were publicly released in a MySQL database script.
AnimeLeague
July 4, 2024
•[ leak, sqlinjection, technology ]
In July 2024, AnimeLeague disclosed a data breach of their services. The data was posted for sale on a popular hacking forum and included 2 databases covering both event registration records and a dump of the phpBB bulletin board. The impacted data included passwords in various hashed formats including SHA-1, salted md5 and bcrypt, as well as usernames, private messages, dates of birth, purchases and 192k unique email addresses.
Evermotion
May 7, 2015
•[ hack, sqlinjection, technology ]
In May 2015, the Polish 3D modelling website known as Evermotion suffered a data breach resulting in the exposure of 435k unique user records. The data was sourced from a vBulletin forum and contained email addresses, usernames, dates of birth and salted MD5 hashes of passwords. The site was previously reported as compromised on the Vigilante.pw breached database directory.
MPGH
October 22, 2015
•[ hack, sqlinjection, technology ]
In October 2015, the multiplayer game hacking website MPGH was hacked and 3.1 million user accounts disclosed. The vBulletin forum breach contained usernames, email addresses, IP addresses and salted hashes of passwords.
CheapAssGamer.com
July 1, 2015
•[ leak, sqlinjection, technology ]
In approximately mid-2015, the forum for CheapAssGamer.com suffered a data breach. The database from the IP.Board based forum contained 445k accounts including usernames, email and IP addresses and salted MD5 password hashes.
FaceUP
January 1, 2013
•[ hack, sqlinjection, technology ]
In 2013, the Danish social media site FaceUP suffered a data breach. The incident exposed 87k unique email addresses alongside genders, dates of birth, names, phone numbers and passwords stored as unsalted MD5 hashes. When notified of the incident, FaceUP advised they had identified a SQL injection vulnerability at the time and forced password resets on impacted customers.
Planet Calypso
July 1, 2019
•[ hack, sqlinjection, technology ]
In approximately July 2019, the forums for the Planet Calypso game suffered a data breach. The breach of the vBulletin based forum exposed email and IP addresses, usernames and passwords stored as salted MD5 hashes.
Atmeltomo
April 16, 2021
•[ hack, sqlinjection, technology ]
In April 2021, "Japan's largest e-mail friend search site" Atmeltomo suffered a data breach that was later sold on a popular hacking forum. The breach exposed 1.3M records with 580k unique email addresses along with usernames, IP addresses and unsalted MD5 password hashes.
Pokémon Creed
August 8, 2014
•[ hack, sqlinjection, technology ]
In August 2014, the Pokmon RPG website Pokmon Creed was hacked after a dispute with rival site, Pokmon Dusk. In a post on Facebook, "Cruz Dusk" announced the hack then pasted the dumped MySQL database on pkmndusk.in. The breached data included over 116k usernames, email addresses and plain text passwords.
Sony
June 2, 2011
•[ hack, sqlinjection, technology ]
In 2011, Sony suffered breach after breach after breach — it was a very bad year for them. The breaches spanned various areas of the business ranging from the PlayStation network all the way through to the motion picture arm, Sony Pictures. A SQL Injection vulnerability in sonypictures.com lead to tens of thousands of accounts across multiple systems being exposed complete with plain text passwords.
Boxee
March 29, 2014
•[ hack, sqlinjection, technology ]
In March 2014, the home theatre PC software maker Boxee had their forums compromised in an attack. The attackers obtained the entire vBulletin MySQL database and promptly posted it for download on the Boxee forum itself. The data included 160k users, password histories, private messages and a variety of other data exposed across nearly 200 publicly exposed tables.
CBIZ KA
December 6, 2023
•[ leak, sqlinjection, healthcare ]
CBIZ KA, a revenue cycle management vendor is affected by a MOVEit breach. Nine of Ontario Prime Healthcare's hospitals are affected.
State of Maine
November 10, 2023
•[ leak, sqlinjection, government ]
The State of Maine announces that its systems were breached after threat actors exploited the vulnerability in the MOVEit file transfer tool and accessed personal information of about 1.3 million, which is close to the state's entire population.
MUSC Health
October 17, 2023
•[ hack, sqlinjection, healthcare ]
MUSC Health says patients' protected health information may have been compromised as its research support and services provider, Westat, was caught in the massive MOVEit hack.
Kearny Bank
October 25, 2023
•[ leak, sqlinjection, finance ]
Kearny Bank joins the list of the victims of the massive MOVEit attack.
