Grails Forum Data Breach
The November 2019 Grails Forum data breach occurred when unauthorized threat actors breached GrailsForum (grailsforum.co.uk), the premier discussion and technical support community dedicated to the Groovy and Java-based Grails web application framework.
Exposed Data Types
4- Email addresses
- Usernames
- Passwords
- IP addresses
About This Breach
The intruder leveraged the critical vBulletin pre-authentication remote code execution vulnerability documented under CVE-2019-16759 to dump the complete member database.
What information was affected in the Grails Forum incident?
The compromised vBulletin database export (grailsforum.co.uk._november2019_vB_88834.csv) contains complete account profiles for developers worldwide. The incident compromised records for 88,118 unique software engineers and developers, exposing:
- Account Identifiers: Community usernames.
- Contact Details: Verified canonical email addresses.
- Security Credentials: Salted MD5 password hashes and accompanying salt strings.
- Network Telemetry: User IP addresses recorded upon registration and activity.
How many accounts were affected?
Strict canonical RFC validation and deduplication confirmed 88,118 unique verified email addresses across 88,834 user table records.
Technical analysis and security risks
The breach was executed via weaponized exploitation of CVE-2019-16759 in the vBulletin forum software. Because software engineers and technology professionals constituted the primary user base, compromised credentials represent an acute threat of automated credential stuffing attacks targeting code repositories (GitHub, GitLab, Bitbucket), CI/CD pipelines, and cloud administration portals.
Recommended actions for affected users
Developers who held accounts on GrailsForum should:
- Immediately rotate passwords across any development, email, or infrastructure accounts sharing the forum password.
- Deploy hardware security keys (FIDO2/WebAuthn) or time-based one-time password (TOTP) authenticators across all code repositories.
- Monitor authorized OAuth applications and SSH keys on developer services for anomalies.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
