GPS Underground 2016 Data Breach

A March 2017 HackRead seller-listing report claims 668,421 user accounts for July 2016 and lists forum IDs, usernames, emails, password hashes, dates of birth, and IP addresses. July 1 is only a month-level marker, not an exact access or exfiltration day, and this event must not be confused with a separate 2010 attack.

LeakData's completed historical job imported 649,348 email relations from a single-column canonical file mapped as email. A fresh live export reproduces the same 649,348 lines and 13,858,640 bytes; the sorted unique set also has 649,348 lines. Two independent current validators agree on 649,338 strict-valid and 10 legacy-format LOCAL_CHARACTER_INVALID relations; the legacy relations were not deleted. The local total is 20,236 below the catalogue measure and 19,073 below the report's claim. Dataset version, normalization, duplicate, null, and rejected-value differences remain unreconciled.

The original historical job file is absent, its backup status is skipped, and the job has neither an input manifest nor a source SHA. The current DHT file contains only the first 5,943,535 bytes of a 44,995,611-byte 7z archive; the final 39,052,076 bytes and the 7z end header are missing. Its member inventory, source email column, whether it is the same dataset as the historical job, and any possible supplemental scope relative to the external measures therefore cannot be re-established from source. Counts were not fitted and no supplemental import was performed.

A private match shows only that the controlled email occurs in the local subset of 649,348 relations. It does not establish identity, forum membership, navigation or GPS interest, IP or location, birth date, username, password, field co-occurrence, compromise, or misuse. The salted-MD5 detail must not be generalized to every row, and a hash is not plaintext. A known old password should be replaced only where it was genuinely reused elsewhere.