leaksear.ch indexed a GhostMarket breach dataset containing 3,331 forum user records tied to a March 9, 2010 breach date, including emails, usernames, IP addresses, dates of birth, password hashes and salts (leaksear.ch metadata). GhostMarket, also reported as Gh0stMarket.net, was a cybercrime forum that public reporting described as having more than 8,000 members worldwide and being used for stolen financial data and malware trade (www.theguardian.com, www.itpro.com).
What happened
Public reports from 2011 tied GhostMarket to a UK prosecution after an 11-month police investigation. The Guardian reported that members traded compromised databases containing account numbers, PINs and passwords, while IT Pro reported that the forum was used for data theft, credit card fraud, malware activity and botnets (www.theguardian.com, www.itpro.com).
Computerworld reported that the site was shut down after the Police Central e-Crime Unit investigation and that police said database files from Gary Paul Kelly's PC helped reconstruct GhostMarket (www.computerworld.com).
leaksear.ch metadata dates the user database breach to March 9, 2010. A contemporaneous Exophase thread with that start date discussed GhostMarket being hacked and warned that users' IP information could be handed to authorities, but that thread does not confirm who accessed the database (forums.exophase.com).
What data was exposed
leaksear.ch indexed 3,331 records from the forum user database. The searchable fields are dates of birth, email addresses, hashed passwords, salts, IP addresses and usernames (leaksear.ch metadata).
Additional record metadata includes forum account IDs, group and rank data, registration and activity timestamps, login-attempt counters, profile fields, privacy and notification settings, avatar and signature settings, private-message counters and legacy instant-messaging handles (leaksear.ch metadata).
Password values in the index are hashes, not plaintext passwords. OWASP notes that hashes can still be cracked in some circumstances if attackers can test candidate passwords against the stored hash (cheatsheetseries.owasp.org).
Why this matters
Email addresses, usernames and dates of birth can support phishing that refers to a real GhostMarket account or old forum profile (leaksear.ch metadata).
Hashed passwords and salts raise credential-reuse risk if weak passwords can be cracked, and OWASP defines credential stuffing as testing username and password pairs from one site breach against another site (cheatsheetseries.owasp.org, cheatsheetseries.owasp.org).
IP addresses can expose historical network or location clues that may help correlate forum accounts with other activity (leaksear.ch metadata).
Forum profile metadata such as registration times, activity timestamps and messaging counters can help analysts correlate accounts, but it does not prove a real-world identity by itself (leaksear.ch metadata).
Check your exposure
Request access to check this leak source, or sign in if you already have an account. You can search it by date of birth, email, hashed password, ip address, salt, and username.
Sources
- The Guardian: Teenagers jailed for running £16m internet crime forum
- IT Pro: Cyber crime teens jailed in GhostMarket bust
- Computerworld: Four who ran credit card fraud market to serve prison time
- Exophase Forums: GhostMarket Hacked Feds suspected
- Finextra: Teenage cybercrime forum founder jailed
- OWASP Cheat Sheet Series: Password Storage Cheat Sheet
- OWASP Cheat Sheet Series: Credential Stuffing Prevention Cheat Sheet