Malwarebytes forum data breach: what happened and what to do

In November 2014, the Malwarebytes forum was hacked and about 112,000 member records were exposed: email and IP addresses, birth dates, usernames and weakly salted password hashes that many attackers could crack.

View all 13,177 breaches

Breach date: 15 Nov 2014
Affected: 111,623
Data exposed: Dates of birth, Email addresses, IP addresses, Passwords, Usernames, Website activity
Verified: Yes
Last updated: 27 Oct 2026

Source: Have I Been Pwned (CC BY 4.0)

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

The Malwarebytes support forum was hacked in November 2014. Have I Been Pwned lists 111,623 member records from the breach and added it to the service in March 2016. The forum ran on IP.Board, a common forum platform.

Only the forum was hit. Malwarebytes' security software and the accounts people use to buy or manage the product weren't part of it.

Sources checked: haveibeenpwned.com

Last verified against the official page: 27 Oct 2026

How we research this Report an error

What was exposed

The records held email addresses, passwords, usernames and IP addresses. Birth dates were in there too, and Have I Been Pwned also lists website activity. The passwords were stored as salted hashes, but the implementation was weak, so attackers could crack many of them fast. If your forum password was a common word or a short phrase, assume someone recovered it.

What that means for you

A cracked password only hurts if you still use it somewhere. Attackers try leaked email and password pairs on other sites, a tactic called credential stuffing. Say you used the same password on the forum and on your email. Someone could have reached your inbox and used it to reset your other accounts.

Email addresses and birth dates also feed phishing. A message that knows your birth date, or that you hung around a security forum, looks more trustworthy than a generic one.

What to do now

The breach is more than a decade old, so you've probably changed passwords since. Still, check that no account you care about uses a password from that period. Start with email and banking. Use a different password on every site.

What to do if you were in it

1

Change the password and anywhere you reused it

Set a new password on the affected account. Then change it on any other site where you used the same one, starting with email and banking. A password manager makes unique passwords painless.
2

Turn on two-factor login

Use an authenticator app or a security key on your email, bank and shopping accounts. A stolen password alone then isn't enough to get in.
3

Expect phishing that mentions the breach

Criminals use your email address and birth date to write messages that look personal. Don't click links in unexpected emails or texts about your account. Go to the site directly instead.
4

Check whether your email or phone is in this and other breaches

Run a free scan with Serus to see which breaches include your email address or phone number. Serus monitors breach databases and the dark web and alerts you if your data shows up again.

Timeline

15 Nov 2014
The breach happened
9 Mar 2016
Added to Have I Been Pwned

Frequently asked

Was I affected by the Malwarebytes forum breach?

Only if you had an account on the Malwarebytes forum in 2014. You can search your email address on Have I Been Pwned to see if it appears in this breach.

What was exposed?

Email addresses and usernames, IP addresses, dates of birth, website activity and passwords stored as weak salted hashes.

Were Malwarebytes products or payment details affected?

Have I Been Pwned lists forum member records only. Payment details aren't among the exposed data types.

Should I change my password?

Yes, if you ever reused your forum password anywhere. Change it on those sites and use a unique one for each account.