MrExcel Data Breach

The data fields exposed in this breach have different risk levels. Email addresses and usernames help attackers associate the user with a MrExcel membership and prepare messages that appear personalized. IP addresses can be matched with approximate connection location and service provider information; alone they do not constitute identification, but when combined with other data, they can facilitate profiling. Birth dates are personal details that can be used in password resets, security question guessing, and social engineering attempts. Social connections and site activity can provide context about in-forum relationships, past messaging habits, or user behavior. The most critical field is password data.Finding passwords as salted MD5 hashes does not mean that the plain text password has been directly published; however, because MD5 is susceptible to rapid trial attacks, short, predictable, or previously used passwords can be broken. If the same password is valid for email, work account, cloud storage, social media, shopping, or other forums, a single forum leak can turn into a much wider risk of account compromise.

The number of verified accounts should be considered as 366,140. The incident date has been verified as December 5, 2016, and the recording date as January 22, 2017. The scope is related to MrExcel forum membership data; therefore, it should not be assumed that all MrExcel visitors, content readers, or store customers were affected in the same way. The official notification specifically distinguishes that store account data was not affected in this incident. On the forum side, it was stated that user ID, email address, and password data in hash+salt form were accessed, and that certain activity information from recent logins, post counts, and similar administrative areas was also visible.Other verification records also listed fields such as date of birth, IP address, social connections, usernames, and site activity, so these fields were preserved in the record. This distinction is important because an overly broad claim in a breach record misleads the user, while a missing data field hides the actual risk. The correct framework for MrExcel is a forum account-centered leak, the risk of password cracking due to a weak hash algorithm, and the potential for chain account takeover for people using the same password across different services.

The group at highest risk consists of people who had a MrExcel forum account before December 2016 and used the same password on other services as well. Users who created an old forum membership for Excel support but have not logged in for years are also included in this group; because forgotten account passwords often remain unchanged in password managers. The second risk group consists of users who use work email in their forum account. People with a forum membership using a corporate email address may receive more convincing phishing messages themed around Excel files, macros, reporting processes, or work documents. The third risk group consists of people who use their date of birth or username information in the same format on other sites.This information can be used in attempts to guess account recovery questions or gain trust through fake support messages. Visibility may be higher for individuals who are active on the forum, frequently ask questions, download plugins, or share social connections on their profile. In technical support communities like MrExcel, users often provide hints about their workflow, industry, or the tools they use. Therefore, attackers can carry out more targeted attempts by using not only the password but also context about user behavior.

Users matching this record should first think about the old password they used on the MrExcel forum and change all accounts where the same or a similar password was used. Password changes should not be limited to the MrExcel account; email accounts, social media, cloud storage, payment, shopping, work tools, and other forum accounts opened with the same email address should also be checked. New passwords should be long, unique, and random; simply adding a number or symbol to the end of the old password should not be considered sufficient. The email account is a priority because if the email is compromised, password reset links for other services are also at risk. Two-factor authentication should be enabled on all important accounts that support it.Users should also be cautious of suspicious messages themed around MrExcel, Excel files, macros, invoices, support requests, security alerts, or password resets. Instead of going to the login screen through links in the message, the address should be manually typed into the browser or trusted bookmarks should be used. Unknown attachments should not be opened, and Office files containing macros should especially not be allowed. If an old forum account is no longer necessary, the option to close the account or reduce profile information should also be considered.

The MrExcel incident shows that old forum accounts can have security impacts even after many years. In the long term, every user should move all their memberships, including forums, to a password manager and reduce repeated passwords to zero. The control tools in the password manager can be preferred to regularly check whether the same password is used across different services. Personal forum accounts opened with a work email should also be separated; protecting both work and personal accounts with the same password or recovery method can cause the risk to be carried over to the corporate domain. Stronger second factors such as app-based authentication or hardware keys should be preferred for critical accounts.The lesson is also clear for forum and community administrators: old forum software and plugins should be updated regularly, password hash algorithms should be moved to modern and slow algorithms, administrator accounts should be separated with extra protection, and user notifications should not be delayed when a breach is suspected. On the user side, unnecessary birth dates, social links, or job information should not be left on old forum profiles. Less profile data reduces the context an attacker could use in a future leak.

A match with the MrExcel record indicates that the relevant email address was found among the forum account data from December 2016. The user should first determine which password they used on this forum, and then update all accounts where the same password may have been used in the past, one by one. Even if the old password cannot be remembered, accounts created during the same period should be considered at risk, and password manager records should be reviewed. In the email account, recent logins, recovery addresses, forwarding rules, and unrecognized devices should be checked. If a suspicious session is found, log out from all devices, reset the password, and enable two-factor authentication.Password reset questions should also be reviewed due to birth date and username information, and unique answers should be used instead of easily guessable ones. Attachments and links in emails that appear to be Excel, macros, file downloads, or forum support messages should be examined particularly carefully. This violation should not be considered as a store account or payment information leak; however, if the forum password is reused on other services, the consequences could extend beyond the forum. Therefore, the most appropriate action is to no longer allow the old forum password to be valid anywhere and to use an additional verification layer on important accounts.