A Lolzteam data leak indexed by leaksear.ch contains exactly 398,201 records from the forum's May 13, 2018 breach, including email addresses, usernames, limited phone numbers, internal account identifiers, profile attributes, and account activity metadata, with no passwords (leaksear.ch metadata). Have I Been Pwned identifies Lolzteam as a Russian hacking forum and says the May 2018 breach exposed roughly 400,000 members; Mozilla Monitor lists the breach date as May 13, 2018 (haveibeenpwned.com, monitor.mozilla.org).
What happened
Public breach tracking places Lolzteam's breach in May 2018. Mozilla Monitor says the breach was discovered and verified before being added to its database on November 6, 2022, and Have I Been Pwned says the exposed usernames and email addresses were later redistributed via another hacking forum (monitor.mozilla.org, haveibeenpwned.com).
A 2019 Breach Report article on Medium stated that Lolzteam member data had been breached on May 13, 2018 and later leaked, exposing email IDs, phone numbers, time zone, and activity details for more than 405,000 community members (medium.com). The reviewed public sources do not identify the original intrusion method, so this article does not describe the incident as ransomware, scraping, or misconfigured storage.
What data was exposed
The leaksear.ch index lists email, phone, and username as searchable fields for this leak (leaksear.ch metadata). Have I Been Pwned and Mozilla Monitor list exposed email addresses and usernames, while leaksear.ch metadata lists limited phone numbers and no passwords (leaksear.ch metadata, haveibeenpwned.com, monitor.mozilla.org).
The stored record context includes internal account identifiers, user state, account visibility, registration and last-activity dates, time zone, language, gender fields, forum activity counts, unread alert and conversation counts, avatar dimensions and dates, donation-related profile fields, and moderation, staff, admin, ban, and warning flags (leaksear.ch metadata).
Why this matters
Email addresses and usernames tied to a hacking forum can help phishers connect identities across services, especially because Have I Been Pwned says the data was redistributed on another hacking forum (haveibeenpwned.com). Limited phone numbers create a second contact channel for SMS lures and account-recovery attempts tied to the same forum identities (leaksear.ch metadata). Internal user IDs, staff and moderator flags, ban indicators, forum activity counts, and last-activity metadata can help identify high-interest accounts and tailor doxing or social-engineering attempts (leaksear.ch metadata). Because the metadata and Mozilla Monitor indicate no passwords were exposed, affected users should focus on phishing, account-correlation, and recovery-channel monitoring, then check this leak by email, phone, or username (leaksear.ch metadata, monitor.mozilla.org).
Check your exposure
Request access to check this leak source, or sign in if you already have an account. You can search it by email, phone, and username.