A data leak attributed to InAttack contains 31,504 member records from a Russian underground forum, including emails, usernames, names, dates of birth, IP addresses and salted password hashes; the breach date is not known from the available metadata (leaksear.ch metadata). Trend Micro's 2012 Russian Underground 101 report listed InAttack among the top forums where Russian cybercriminals bought and sold wares (dl.packetstormsecurity.net).
What happened
The incident, as indexed, is a leak of a forum member dataset rather than a publicly confirmed new intrusion. leaksear.ch metadata lists the dataset under InAttack, indexed on October 15, 2026, with no reporter, breach date or exposure method (leaksear.ch metadata).
Public context supports InAttack as a cybercrime-forum source of interest. Trend Micro listed InAttack in a top-10 set of Russian cybercriminal forums, and Dark Reading reported the same list when covering Trend Micro's research (dl.packetstormsecurity.net, www.darkreading.com).
No public source loaded for this article confirmed whether the dataset came from ransomware, scraping, a forum-software compromise, a database dump or misconfigured storage. The supplied metadata also does not identify an exposure vector, so those details remain unconfirmed (leaksear.ch metadata).
What data was exposed
The indexed InAttack records include email addresses, usernames, names, dates of birth, IP addresses, salted password hashes and salts (leaksear.ch metadata).
The records also contain non-search account metadata, including forum member IDs, group IDs, join and activity fields, post and message counts, language and time-zone settings, profile-view counts, ban and warning flags, and social-integration identifiers or token fields (leaksear.ch metadata).
Why this matters
Email addresses and usernames from an underground forum can support targeted phishing or account-takeover attempts against people who reused the same handles or addresses on other services. Names, dates of birth and IP addresses can help connect a forum identity to a real person or location, increasing doxxing, extortion and fraud risk for people in the dataset. Salted password hashes are not plaintext passwords, but exposed hashes tied to emails or usernames should still be treated as compromised credential material because attackers may try password recovery and credential-stuffing attacks. If you had an InAttack account or reused an email address or username connected to one, check this leak so you can prioritize password resets, account reviews and fraud monitoring.
Check your exposure
Request access to check this leak source, or sign in if you already have an account. You can search it by date of birth, email, hashed password, ip address, name, salt, and username.