Malwarebytes

In November 2014, the community forum operated by Malwarebytes, the cybersecurity software company, was hacked. According to our investigation team, the incident exposed more than 111,000 forum member records, including email addresses, usernames, IP addresses, and passwords for a large share of those accounts. Malwarebytes acknowledged at the time that a vulnerability in its forum software had let a hacker gain access to the server hosting the community, and it forced all users to reset their passwords as a precaution. The company said then that it had no evidence personal data had been stolen, but member records from the forum later surfaced in breach data, which is what this listing documents.

Limited public reporting: As of September 25, 2026, detailed company notices or major news coverage for this listing were limited in sources reviewed. The facts below rely primarily on the indexed fields plus any secondary sources cited.

Breach Timeline

November 10, 2014: A vulnerability in the forum software allowed a hacker to gain access to the server hosting the Malwarebytes community, according to an email the company sent to users that was quoted by Tidbits for Techs.

November 2014: Malwarebytes forced all forum users to reset their passwords and moved its community onto hosting run by the forum software maker, the company said in the same notice.

What Information Was Compromised?

Our analysis found the following data types in this breach: IP addresses for 111,611 records, usernames for 111,609 records, email addresses for 111,604 records, and passwords for 82,508 records.

Secondary reporting on this incident, including a summary by Twingate, indicates the forum records also contained dates of birth and website activity data.

Not every individual is affected by every type of data listed here.

What Are the Potential Risks for Affected Individuals?

Exposed email addresses and usernames can be used for phishing, in which scammers send convincing messages that appear to come from a legitimate company to trick you into revealing more information or clicking malicious links. Because the forum records tie those details to IP addresses and account activity, the data can also help attackers build believable profiles of specific people.

The passwords are the most immediate concern. When forum passwords are cracked and circulated, attackers try them on other websites, a technique called credential stuffing. If you reused your forum password anywhere else, including your email account, banking, or shopping sites, those accounts may be at risk even years later. Old breach data like this is frequently repackaged and recirculated, so the risk does not disappear with time.

What Should You Do If You Were Affected?

If you had an account on the Malwarebytes forum, take these steps:

Change your password on any account that used the same password as the forum, and make sure your email account uses a unique, strong password.

Do not reuse passwords across sites. A password manager can generate and store distinct passwords for every account.

Turn on two-factor authentication wherever it is offered, especially for email and financial accounts.

Watch for phishing. If you were in this breach, your email address is known to attackers. Be cautious about unexpected messages asking you to log in, pay, or open attachments.

Neither a password change after the fact nor two-factor authentication erases data already leaked, but both sharply reduce the chances that leaked credentials can be used against you today.