leaksear.ch indexed a BHF.IO data leak containing 771 member-account records attributed to the Russian-language Best Hack Forum, including email addresses, usernames, IP addresses, salts and salted password hashes (leaksear.ch metadata). No breach date is listed for this dataset (leaksear.ch metadata).
What happened
Public sources identify BHF.IO, also known as Best Hack Forum, as a Russian-language forum centered on hacking. Flare describes BHF as an established Russian-language forum focused on credential sales, spam and data leaks, with topic areas including software cracking, exploits, combolists, stealer logs, spam tools and tutorials (flare.io). WikiReality describes BHF.IO as a Russian forum dedicated to hacking and lists bhf.io as its web address (wikireality.ru).
leaksear.ch metadata does not identify a breach date, compromise vector, or actor, and the public sources reviewed for this article do not confirm how these 771 account records were obtained. The confirmed point for this article is that the indexed dataset contains member-account records attributed to BHF.IO/Best Hack Forum, not that a specific intrusion, ransomware event, scraping event, or misconfigured service caused the exposure (leaksear.ch metadata).
What data was exposed
The indexed records include usernames, email addresses, IP addresses, salts, salted password hashes, and forum metadata (leaksear.ch metadata). The searchable fields in leaksear.ch are email, username, IP address, salt, and hashed password (leaksear.ch metadata).
Additional stored fields include join and activity timestamps, language and timezone settings, birthday components, member IDs, group IDs, post and message counts, profile-view and reputation fields, photo and profile settings, warning or ban fields, failed-login fields, and private-message or notification settings (leaksear.ch metadata).
Why this matters
Email addresses paired with usernames can help attackers target forum members with account-recovery phishing or credential-reuse checks, especially because Flare describes BHF as a forum where credential sales and data leaks are core topics (flare.io). IP addresses can reveal historical network locations tied to pseudonymous forum accounts, which raises doxxing and correlation risks for users who reused handles across other services (leaksear.ch metadata). Salted password hashes are not plaintext passwords, but they still create risk if a user reused the same password elsewhere and the hash is later cracked or matched against prior exposures (leaksear.ch metadata). Profile and activity fields such as join dates, last activity, posts, messages, groups, warnings, and bans can support impersonation or social-engineering pretexts against forum users and their contacts (leaksear.ch metadata).
Check your exposure
Request access to check this leak source, or sign in if you already have an account. You can search it by email, hashed password, ip address, salt, and username.