The popular hacking forum OGUsers was hacked again, it is the second security breach it has suffered in a year, the news was first reported by ZDNet.
OGUsers is a black marketplace known for selling any kind of stolen data, including Instagram, Fortinet, Minecraft, Steam, PSN, Fortinet, Skype, and Snapchat accounts. The site was also used by crooks to manage the organizations of SIM swapping attacks.
OGUsers’ administrator ACE who disclosed the security breach admitted that an unknown hacker uploaded a shell to the avatar uploading feature and stole personal data of over 200,000 registered users.
“It appears that someone was able to breach the server through a shell in avatar uploading in the forum software and get access to our current database dating April 2, 2020,” said Ace.
The data breach notice discovered by the data breach monitoring service Under the Breach.
The administrator first forced a password reset for the users, then he asked them to enable two-factor authentication (2FA) for their accounts before putting the forum offline into maintenance mode.
The forum users should know everything about account hijacking since this is how OGUsers became widely known in the first place.
In May 2019, the administrator of the forum disclosed a first data breach:
“More unfortunate news,” the administrator, who goes by Ace, wrote. “It appears someone was able to breach the server through a custom plugin in the forum software and get access to an old backup dating December 26, 2018.”
The incident exposed details for the site’s 113,000 users, attackers completely wiped the forum’s hard drives and dumped the stolen data on a rival hacking forum.
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.