YouHack data breach: what was exposed and what to do

In short: The YouHack data breach, added to Have I Been Pwned on 11 Nov 2026, exposed email addresses, usernames, IP addresses and mostly unsalted MD5 password hashes tied to 7.2 million unique email addresses. The underlying intrusion happened at the Russian-language hacking forum YouHack back in May 2013, and the data was later redistributed before being added to this HIBP listing 13 years later. If you reuse passwords, check whether your email address was in this breach and change that password everywhere you used it.

A decade-old break-in at a Russian cybercrime forum has resurfaced as a fresh privacy problem for millions of people, most of whom never set foot on the forum itself. Here's what was actually taken, who's at risk, and what to do about it right now.

What data was exposed in the YouHack breach?

The exposed data falls into four categories: email addresses, IP addresses, passwords, and usernames, according to Have I Been Pwned's breach listing. For the forum's own members — about 107,000 of them — that meant usernames, IP addresses and password hashes stored as MD5, "most of which were unsalted." But forum posts also contained email-and-password pairs belonging to other people entirely, victims whose credentials members had posted on the forum. Add those in and the total reaches 7.2 million unique email addresses, per HIBP.

Who is affected by the YouHack breach?

Two different groups, with two different risk levels. The smaller group — roughly 107,000 forum members — has the more serious exposure: their usernames, IP addresses and crackable password hashes were all tied together, which LavX News reports "raise the risk of identification, account takeover and reuse attacks on other services." The much larger group — millions of people whose email and password pairs simply turned up in forum posts as other people's stolen data — faces a longer-running risk of fraud and phishing, since that data has apparently been circulating for over a decade.

What risks do the exposed credentials pose?

The main danger is password reuse. MD5 is, as TechRadar explains, "wildly outdated and insecure, because threat actors can crack them easily using off-the-shelf software and hardware." Because most of the hashes weren't salted — meaning no unique random value was added before hashing — attackers can use precomputed tables to match identical passwords across huge numbers of accounts at once, rather than cracking each one individually. Once a password is cracked, it "can be used to access other accounts where victims have reused them," per TechRadar. That's the core threat even though the original intrusion is 13 years old: a 2013 password, if it's still in use anywhere, is still a live risk in 2026.

Who was behind the YouHack breach?

That's not known. TechRadar describes the original 2013 intrusion as being carried out by "unnamed miscreants," with no further identifying detail in any source reviewed for this article. It's also not established exactly whose data makes up the 7.2 million email addresses beyond the forum-members-plus-posted-victims split described above, and there's no confirmation that national ID numbers are part of this dataset — HIBP's compromised-data list names only email addresses, IP addresses, passwords and usernames.

Notably, the youhack.ru domain remains online and active today. According to LavX News, "after the 2013 intrusion, YouHack moved to a different domain and continues to operate as a marketplace for stolen credentials and financial data." No official breach notice from the operators was found on the site.

What should I do if my data was exposed in the YouHack breach?

• Check whether your email address appears in the breach using Have I Been Pwned — see our guide on how to check if your data was leaked.
• If you've used the exposed password anywhere else, change your password on every account where it appears, immediately — HIBP's own advice.
• Enable two-factor authentication wherever it's supported, which HIBP recommends as a standing defense against stolen credentials.
• Watch for follow-up scams: learn to spot phishing after a data breach, since attackers often use leaked emails and passwords to craft convincing messages.
• Consider a credit warning if you fear identity theft: Denmark's official digital security service explains how a credit warning works and how to set one up.
• Stop reusing passwords across services; a password manager makes unique passwords for every account practical going forward.
• If you were ever a registered member of the YouHack forum, treat that account as fully compromised: your username, IP address and password hash were exposed together, which raises the risk of being identified and of attackers trying the same password elsewhere.