Have I Been Pwned has added a breach from YouHack, a Russian-language hacking forum, to its database, 13 years after the forum was compromised. The listing was added on 11 November 2026 and covers the forum's members as well as a much larger collection of credentials found alongside the forum data.

The breach dates to 29 May 2013. About 107,000 YouHack members had email addresses, usernames, IP addresses and passwords exposed. The passwords were stored as MD5 hashes, most of them without salt, which makes them relatively easy to crack. The material also contained email and password pairs belonging to other people, bringing the total dataset to about 7.2 million unique email addresses.

What the 7.2 million figure really means

The headline number needs care. Have I Been Pwned says 87% of the addresses in the collection were already in its database from earlier breaches, so most of the 7.2 million are not newly exposed people. The figure counts unique addresses in the wider credential collection, not 7.2 million YouHack members, and it is not evidence of a new attack on YouHack in 2026.

Even so, the listing matters because old credentials keep circulating. Passwords reused from 2013 can still unlock accounts today, and the exposed data can feed phishing and credential-stuffing attacks, in which criminals try leaked passwords across many services.

What to do

Anyone who used YouHack, or reused the same password elsewhere, should change that password and any others that match it, and switch on two-factor authentication where it is available. People can check whether their address appears in the breach at haveibeenpwned.com.