Hacking website Cracked.to was dealt a massive blow last month when a rival hacking website breached their database that contained 749,161 unique email addresses, and usernames, IP addresses, private messages and passwords stored as bcrypt hashes.
The data breach was executed on July 21, 2019, and contained information belonging to 321,000 Cracked.to members, as reported by HaveIBeenPwned. The date was confirmed by the breached website in a forum thread.
According to Ars Technica‘s report, one of the files they reviewed on the rival site Raidforums — who claimed responsibility for the attack and published the database — contained details such as usernames, email address and IP addresses of buyers and sellers of support software that could potentially help in cracking Fortnite accounts.
Typically, on such forums, users create email IDs and user names that couldn’t be used to tie to them directly — a pseudonym of sorts — and use service like Tor to ensure dynamic IPs.
Cracked.to describes itself as a community forum that provides “cracking tutorials, tools, combo lists and marketplace”, among other things.
Also read: Which files does ransomware encrypt?
Several days after the breach, one of the site admins (floraiN) said in a forum post that the database breach was executed by “an old person of my trust”, and also called Raidforums “a wannabe leaking forum”. The admin also goes on say that this person has forum backups that contain database and folder files, which are valid between the end of 2018 until June 2019.
“Since it’s no longer in my hands that the database and forum files remain private, I wanted to use this thread to give everyone a warning about what could happen,” the admin continued.
Following the database leak on the rival site, all the Cracked.to members were forced to change their passwords. However, the admin also mentioned that stronger hashing algorithms were put in place to secure user passwords. “We have changed the hashing algorithm of passwords from mybb default (md5) to something more advanced a few months ago, which makes it almost impossible to decrypt your passwords.”
In an update last Friday to the same thread, the admin mentioned that all the mybb_sessions had been wiped and “there will be consequences for the forum that is responsible for distributing the backup and for the person that leaked it”.
Also read: Hacking Android: How your phone can be compromised by a rogue app