Net54Baseball Alleged Data Exposure
The 2024 Net54Baseball data breach occurred in February 2024 when Net54Baseball (net54baseball.com), a long-standing online discussion community and marketplace for vintage baseball card collectors and sports memorabilia enthusiasts, suffered an unauthorized intrusion into its vBulletin forum database by an actor operating under the handle '@Seacoat'.
Exposed Data Types
7- Email addresses
- Usernames
- Passwords
- Password salts
- IP addresses
- Dates of birth
- Website activity
About This Record
What information was affected in the Net54Baseball incident?
The leaked SQL database export (net54baseball.com_user.sql) comprises 548,353 forum user accounts. Technical analysis confirms the compromise of the following data classes:
- Identity & Collector Handles: Forum usernames, display names, user group memberships, and custom titles.
- Contact Coordinates: Validated user email addresses.
- Authentication Credentials: User passwords hashed and salted using vBulletin's MD5 algorithm (
md5(md5(pass)+salt)). - Network & Telemetry Data: IP addresses recorded during registration and account activity.
- Demographic & Forum Activity Data: User-supplied dates of birth, join dates, last activity timestamps, post counts, and private messaging indicators.
How many accounts were affected?
Rigorous RFC 5322 ASCII canonical verification confirmed 542,969 unique valid email addresses across the database.
Technical analysis and security risks
Salted MD5 password hashes provide negligible resistance against modern GPU-accelerated dictionary attacks. Because community members frequently trade and purchase high-value collectibles, the exposure of linked email addresses, usernames, and IP locations exposes collectors to targeted spear-phishing, credential stuffing across online auction houses (e.g., eBay, Goldin, PWCC), and physical shipment diversion scams.
Recommended actions for affected individuals
Net54Baseball community members should:
- Immediately update passwords across all auction and collector portals where identical credentials were used.
- Activate multi-factor authentication (MFA / 2FA) on all financial, collecting, and email services.
- Exercise heightened caution regarding unsolicited offers, private transactions, or messages referencing their forum handle.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
