In January 2026, outlets reported the release of a database associated with BreachForums containing nearly 324,000 member records. Resecurity and Dark Reading say the data includes usernames, email addresses, IP addresses and registration dates. Sources give slightly different totals (323,986 and 323,988); these are records, not necessarily distinct people.
Resecurity said some entries were authentic while others appeared altered, removed or replaced. Its analysis also reports that a password for a PGP private key associated with official forum messages was published separately on January 10. Sources do not confirm that member account passwords or private messages were in the member table.
What the sources establish
The January report concerns a member table attributed to BreachForums. Resecurity and Dark Reading report email addresses alongside usernames, registration dates and IP addresses. TechRadar counts 323,988 records; Resecurity counts 323,986. BleepingComputer notes that some analyzed IP addresses were public, while other entries used a local loopback address.
Resecurity says the database is not uniformly reliable: some records can be cross-checked, while others appear altered or may not represent real data. The reported figure should therefore be presented neither as a count of confirmed individuals nor as proof that every field is accurate.
What the leak does not prove
Resecurity and Dark Reading report that email addresses were in the member table. However, the sources reviewed do not establish that member account passwords or private-message content were included. Resecurity says a PGP private-key password was published separately; this should not be confused with member account passwords.
Likewise, an IP address in a record is not enough to identify a person or prove who controlled an account at a particular time. Data needs to be considered in context, including its reliability and collection date; Resecurity’s analysis reportedly found the latest registration date to be August 11, 2025.
The practical risk for former members
The leak may make some profile or activity information easier to correlate. That could increase the risk of targeted messages, impersonation or extortion attempts, without proving that a sender still has access to someone’s account or device.
Password risk is conditional: if a former member reused the same secret elsewhere, and that secret was obtained through a different breach or phishing attempt, the other account may be at risk. Nothing in the cited reports attributes password exposure to the January table.
Steps for people who may be affected
If you had an account and reused its password elsewhere, change it on every service where it was used, starting with email and accounts that can reset other access. Choose a unique secret and enable multi-factor authentication where available. A secure password generator can help create distinct passwords.
Treat unexpected messages cautiously, even when they quote a username or accurate detail. Do not use links in a payment demand or offer to “delete” data; verify alerts through the relevant official site or channel. For more on credential theft, see our infostealer guide.
What organizations can check
An employee email address or username appearing in an external dataset is a signal to investigate, not proof that the employer’s system was compromised. Teams can check for known password reuse under their privacy rules, review unusual logins, and revoke sessions or change access when their own evidence supports it.
Avoid treating a match based only on a username or IP address as conclusive. Decisions should rely on multiple indicators and organizational context, without downloading or redistributing stolen data.
The Soclyde connection
The practical access-management lesson is not to reuse a password between a forum and an important account. Soclyde’s local encrypted vault is designed to help users keep unique secrets under their control. It does not determine whether someone appears in this leak, protect published metadata or replace checking the relevant accounts.
Takeaway
Sources describe nearly 324,000 member records, some of which may be inaccurate. They report email addresses in the table, but do not confirm exposure of member account passwords or private messages. Resecurity separately reports publication of a PGP private-key password. If you reused a password, change it on affected services and secure your email first. You can contact the Soclyde team to learn more about local password management.
