Credentials of 1.9 million Dota 2 forum members leaked

The site Leakedsource claims to have a database containing the credentials of 1.9 million members of the Dota 2 Dev forum. The data includes e-mail addresses, IP addresses and passwords.

The site goes on to say that the passwords were hashed with md5 and salted them. Because md5 is a very outdated algorithm, Leakedsource has been able to decrypt more than eighty percent of passwords to date. It is expected that the remaining passwords can also be cracked. The data was allegedly stolen during a hack that took place on July 10. ZDNet reports that the hacker took advantage of a SQL leak in outdated vBulletin software, which runs the forum of the popular Valve game.

That wouldn’t be unusual, as many forums use this software and outdated vBulletin versions are known to contain vulnerabilities. For example, the forums of Ubuntu and of the game Clash of Kings have been hacked in this way. In addition to IP addresses and passwords, usernames and identifiers have also been stolen from the Dota 2 Dev forum.

It is therefore advisable to change the password used and to do the same on other sites where the same data is logged in.