PoliceOne: A hacker is currently selling hundreds of thousands of police and federal employee accounts from a hacked police forum.
The database is said to have been stolen in 2015, and contains 715,000 member accounts of PoliceOne.com, a news website with a forum for police officers and law enforcement professionals.
According to a post on a Dark Web marketplace, the stolen data includes usernames, passwords encrypted with MD5 (an algorithm that is easy to crack these days), email addresses, dates of birth, and other forum data, such as whether a member is a verified police officer.
It should be noted that many of the forums are private and can only be accessed by members, or in some cases only by verified officers who have submitted their badge number or other identifying information. The latest data that helps verify officers does not appear to be in the leaked database.
The data is being sold for $400, according to the publication. The data seller, who uses the pseudonym Berkut, is also offering samples for data verification.
Berkut told ZDNet that the SQL database was stolen using a known exploit for the forum software, vBulletin. It should be noted that to this day, the software used by the forum has not been updated since 2014, which makes it extremely vulnerable to attacks.
The forum is currently offline and a PoliceOne representative reported contradictory things:
“We have confirmed the credibility of an alleged breach of the PoliceOne forum in which hackers were able to obtain usernames, emails, and hashed passwords for a portion of our members.”
"While we have not yet verified the claim, we are taking immediate steps to secure user accounts and our forum, which is offline, while we investigate to gather more information."
