GSM-Hosting Forum 2016 Data Breach

The current verified breach catalogue reports 2,607,440 accounts or unique email identifiers in an August 2016 dataset and lists emails, usernames, IP addresses, and salted MD5 password hashes. An archived March 2017 HackRead report relays a seller claim of 2,611,291 forum accounts with forum IDs, usernames, emails, password hashes, and IP fields. August 1 is only a month-level catalogue marker, not an exact access or exfiltration day.

LeakData's completed historical job imported 2,609,857 email relations from a normalized one-column file mapped as email. A fresh live Mongo export reproduced the same 2,609,857 lines and 57,430,803 bytes; the sorted unique set also contains 2,609,857 lines and the same byte count. The local total is 2,417 above the public breach source measure and 1,434 below the seller claim reported by HackRead. Dataset version, normalization, duplicates, nulls, or invalid values do not reconcile these differences, and no external count was fitted.

Two independent current parsers agree on 2,609,643 strict-valid and 214 legacy-format relations. Of the legacy-format group, 202 fail the current ASCII local-part rule and 12 fail the top-level-domain character rule. These are pre-existing indexed relations; this audit did not delete, repair, or re-import them. The historical job's original file is no longer present on disk, there is no input manifest or source SHA-256 record, and backup status is skipped. The job record proves a one-column email mapping, but the transformation from the original archive to that normalized file cannot now be reproduced.

The DHT working copy contains only the final 19,394,501 bytes of the 148,114,585-byte GSMHosting archive; the first 128,720,084 bytes are unavailable. The available tail, the next complete GSkill archive, and the beginning of GTAGaming exactly reproduce three consecutive 32 MiB torrent pieces against the metainfo SHA-1 values; this proves byte position only. The 7-Zip start header and final inventory are unavailable, so member inventory, field schema, email-column authority, archive-to-job identity, and supplemental coverage cannot be proven. No new or gap-filling import was performed from this tail.

Local search contains email relations only; usernames, IPs, forum IDs, and password hashes are not locally searchable. A private result establishes only that the controlled email occurs in the local subset attributed to the forum. It cannot establish identity, account ownership, forum use, a username, IP, password, field co-occurrence, compromise, or misuse. Salted MD5 is not plaintext, although weak passwords may be guessed offline; only an authenticated old password reused elsewhere should be replaced. Forum or technical-community association and credential data remain sensitive.