Updated October 2026: This post has been expanded from its original December 2013 version with a full account of the November 2013 MacRumors Forums breach, how it mirrored the Ubuntu Forums attack earlier that year, and password-security advice that still holds today. It is a historical account; details describe the time it covers, not today.
On Monday, November 11, 2013, someone broke into the MacRumors Forums, one of the largest online communities for Apple fans. Within a day, the site's founder, Arnold Kim, told members to assume the worst: their usernames, email addresses, and hashed passwords should be treated as known to an attacker. At the time, the forums had a little over 860,000 registered members.
The method looked familiar. Kim said the intrusion resembled an attack on the Ubuntu Forums in July 2013, in which an attacker had started with a single moderator account and worked up to the entire user database. This post looks back at what happened at MacRumors, what the attacker claimed, how the Ubuntu incident explains the technique, and what both breaches still teach about protecting your own accounts.
What happened at MacRumors
MacRumors is a long-running news site about Apple products, and its forums are a separate, very active discussion board. In 2013, the forums ran on vBulletin, a popular commercial forum package. SecurityWeek, reading the page source at the time, reported that the site was using vBulletin version 3.8.7.
According to Kim's advisory, the intruder logged in using the account of one of the forum's moderators. From there, the attacker escalated privileges, meaning they used that trusted account to gain more powerful access, and reached the database table that stored user login details. Kim said logs showed the attacker trying to access the password database, and that the team believed at least some user information had been taken.
MacRumors brought in an outside security researcher to investigate and took steps to get the forums working and more secure. How the moderator's credentials were first obtained was not publicly established.
How the passwords were stored
Kim told Graham Cluley that passwords had been salted and hashed using vBulletin's standard MD5-based scheme, with a different salt for each user. A hash is a one-way mathematical fingerprint of a password. A salt is a random value added before hashing so that two people with the same password end up with different hashes, and so that attackers cannot use precomputed lookup tables.
Salting helps, but MD5 is a fast algorithm that was never designed for password storage. A modern graphics card can try enormous numbers of MD5 guesses per second, so short or common passwords can still be recovered quickly. Cluley described MD5 as probably inadequate for storing passwords, and The Hacker News noted that MD5's own author had warned in 2012 that it was no longer safe for this purpose.
The attacker speaks
Shortly after the breach, someone claiming responsibility posted on the MacRumors Forums. According to Threatpost, Kim confirmed the post was genuine; the poster had included part of Kim's own password hash and salt as proof. The poster said 860,106 password hashes had been taken, and that 488,429 of them used salts at least three characters long, which made them slower to crack.
The attacker described the intrusion as "friendly," said they were not mass-cracking the hashes, and promised not to leak the data or use it to break into other services. They also argued the breach succeeded because of a stolen moderator login, not outdated software, and placed the blame on users who reused passwords. At the same time, they pointed out that cracking such hashes with the free tool hashcat and a few word lists returned results quickly.
None of those promises could be verified. Some forum members reported that Yahoo email accounts linked to their MacRumors profiles were locked for suspicious activity, SecurityWeek noted, although a direct link to the breach was not established. The safe assumption, which MacRumors itself urged, was that the data might be used.
The Ubuntu Forums blueprint
The Ubuntu Forums breach of July 2013 is the best-documented example of the same technique, thanks to a detailed post-mortem from Canonical, the company behind Ubuntu. It explains how a single moderator account can lead to a full database theft.
- A moderator account is compromised. On July 14, 2013, the attacker logged in as a community moderator. How that account was first compromised was never determined.
- A booby-trapped announcement. Moderators could post announcements, and vBulletin allowed unfiltered HTML in them by default. The team believed the attacker planted a cross-site scripting payload in an announcement, designed to steal the login cookies of anyone who viewed it.
- Social engineering an administrator. The attacker messaged three administrators, claiming there was an error on the announcement page. One checked the page and replied. Thirty-one seconds later, the attacker logged in as that administrator.
- Taking over the server. With administrator rights, the attacker installed a vBulletin "hook," which runs code on every page load, and used it to install tools that gave shell access on the forum servers.
- Stealing the data. The attacker downloaded the user table, containing usernames, email addresses, and salted MD5 password hashes for about 1.82 million users. On July 20, they returned to deface the site.
Canonical said there was no evidence that Ubuntu itself, its code, or its update systems were affected. Its cleanup involved rebuilding the servers, resetting every password, restricting HTML posting to administrators, moving logins to Ubuntu's single sign-on system, and automatically expiring inactive moderator and administrator accounts.
A bad year for passwords
The MacRumors breach came during one of the worst years for password leaks up to that point. A week later, on November 18, 2013, vBulletin itself disclosed that its own network had been attacked and that customer IDs and encrypted passwords had been accessed. The Register reported that a group calling itself Inj3ct0r claimed responsibility for both the vBulletin and MacRumors attacks and said it was selling an exploit for vBulletin. That claim conflicted with the MacRumors attacker's own account of using a stolen moderator login, and neither claim was independently confirmed.
The largest leak of the year came from Adobe. Its October 2013 breach exposed records for around 153 million accounts, according to Have I Been Pwned. Adobe's passwords were encrypted poorly rather than hashed, and password hints were stored in plain text, which made many of them easy to guess.
| Breach | When | Accounts | How passwords were stored |
|---|---|---|---|
| Ubuntu Forums | July 2013 | About 1.82 million | Salted MD5 hashes (vBulletin) |
| MacRumors Forums | November 2013 | About 860,000 | Salted MD5-based hashes (vBulletin) |
| vBulletin.com | Disclosed November 18, 2013 | Not disclosed | Described as encrypted passwords |
| Adobe | October 2013 | About 153 million | Poorly encrypted, with plain-text hints |
Sources: Canonical, Graham Cluley, Threatpost, The Register, Have I Been Pwned.
That wave of leaks helped inspire a service many people still use. In December 2013, security researcher Troy Hunt launched Have I Been Pwned, a free website that lets anyone check whether their email address appears in known breaches. PCWorld reported that it launched with data from breaches including Adobe, Yahoo, Sony, Stratfor, and Gawker.
What happened next
The MacRumors Forums recovered and remained active. At the time, Kim said there was no indication that the stolen passwords were circulating online. The bigger change was in the industry. Breaches like these pushed sites away from fast hashes such as MD5 toward slow, purpose-built password hashing algorithms, and pushed users toward password managers and two-factor authentication.
Guidance has also changed. The OWASP Password Storage Cheat Sheet now recommends Argon2id first, with scrypt, bcrypt, or PBKDF2 as alternatives, and says fast algorithms like MD5 and SHA-1 should not be used for passwords. The U.S. National Institute of Standards and Technology, in the 2025 revision of its digital identity guidelines (SP 800-63B), dropped arbitrary complexity rules and routine forced password changes, and instead calls for screening new passwords against lists of known-breached and common passwords.
How to protect yourself
The MacRumors attacker blamed password reuse, and that part of the message was correct. A leak from one forum becomes dangerous when the same email and password unlock your email, bank, or cloud storage. These steps remain the most effective defenses.
1. Use a unique password for every account
If every site has a different password, a breach at one site cannot be replayed against another. This single habit would have neutralized most of the risk from the MacRumors leak.
2. Let a password manager do the work
Nobody can remember hundreds of random passwords. A reputable password manager generates and stores them for you, and fills them in only on the correct website, which also helps against phishing.
3. Make passwords long rather than complicated
Length matters more than symbols. Current NIST guidance sets a 15-character minimum when a password is the only factor protecting an account. A passphrase of several random words is both long and easy to type.
4. Turn on two-factor authentication or passkeys
A second factor, such as an authenticator app, a hardware security key, or a passkey, means a stolen password alone is not enough to get in. Prioritize your email account, because it can be used to reset everything else.
5. Check whether you have been exposed
Search your email address on Have I Been Pwned. If it appears in a breach, change that password and any other account where you used the same one.
6. If you run a forum or website
Protect staff and moderator accounts with two-factor authentication, remove permissions from inactive moderators, limit who can post raw HTML, keep forum software updated, and store passwords with a modern algorithm such as Argon2id or bcrypt. These are almost exactly the fixes Canonical adopted after the Ubuntu breach.
The bottom line
The MacRumors Forums breach was not the largest of 2013, but it was a clear lesson in how attacks on community sites work. Attackers did not need a sophisticated exploit to start; a single moderator login was enough. And once the hashes were out, the people at greatest risk were those who used the same password elsewhere. More than a decade later, unique passwords, a password manager, and two-factor authentication are still the simplest ways to make sure someone else's breach does not become your problem.
Sources
- Help Net Security, "MacRumors forums hacked, 860k user passwords compromised" (November 13, 2013)
- SecurityWeek, "MacRumors Forums Hacked, 860K Hashed Passwords Exposed" (November 13, 2013)
- Threatpost, "MacRumors Forums Hacker Says Passwords Won’t Be Leaked" (November 13, 2013)
- Graham Cluley, "MacRumors hacked: 860,000 email addresses and hashed passwords stolen" (November 14, 2013)
- The Hacker News, "MacRumors Forum hacked, more than 860,000 users at risk" (November 13, 2013)
- Canonical, "Ubuntu Forums are back up and a post mortem"
- The Register, vBulletin hacked (November 18, 2013)
- Have I Been Pwned, Adobe breach entry
- PCWorld, "New website lets users check if their online credentials were exposed in large data leaks" (December 6, 2013)
- OWASP, Password Storage Cheat Sheet
- Enzoic, summary of NIST SP 800-63B Revision 4 (2025)
Top image: "Padlock" by Alyson Hurt from Alexandria, Va., USA, CC BY 2.0, via Wikimedia Commons (resized). Charts by Thank You Robot.
0 Comments