Ogusers[.]com — a forum popular among people involved in hijacking online accounts and conducting SIM swapping attacks to seize control over victims’ phone numbers — has itself been hacked, exposing the email addresses, hashed passwords, IP addresses and private messages for nearly 113,000 forum users.
On May 12, the administrator of OGusers explained an outage to forum members by saying a hard drive failure had erased several months’ worth of private messages, forum posts and prestige points, and that he’d restored a backup from January 2019. Little did the administrators of OGusers know at the time, but that May 12 incident coincided with the theft of the forum’s user database, and the wiping of forum hard drives.
On May 16, the administrator of rival hacking community RaidForums announced he’d uploaded the OGusers database for anyone to download for free.
The administrator of the hacking community Raidforums on May 16 posted the database of passwords, email addresses, IP addresses and private messages of more than 113,000 users of Ogusers[.]com.
The database, a copy of which was obtained by KrebsOnSecurity, appears to hold the usernames, email addresses, hashed passwords, private messages and IP address at the time of registration for approximately 113,000 users (although many of these nicknames are likely the same people using different aliases).
The publication of the OGuser database has caused much consternation and drama for many in the community, which has become infamous for attracting people involved in hijacking phone numbers as a method of taking over the victim’s social media, email and financial accounts, and then reselling that access for hundreds or thousands of dollars to others on the forum.
Several threads on OGusers quickly were filled with responses from anxious users concerned about being exposed by the breach. Some complained they were already receiving phishing emails targeting their OGusers accounts and email addresses. 
Meanwhile, the official Discord chat channel for OGusers has been flooded with complaints and expressions of disbelief at the hack. Members vented their anger at the main forum administrator, who uses the nickname “Ace,” claiming he altered the forum functionality after the hack to prevent users from removing their accounts. One user on the Discord chat summed it up:
“Ace be like:
-not replace broken hard drives, causing the site to time warp back four months
– not secure website, causing user info to be leaked
– disable selfban so people can’t leave”
It’s difficult not to admit feeling a bit of schadenfreude in response to this event. It’s gratifying to see such a comeuppance for a community that has largely specialized in hacking others. Also, federal and state law enforcement investigators going after SIM swappers are likely to have a field day with this database, and my guess is this leak will fuel even more arrests and charges for those involved.
(from screenshot in article)
“denzel_8487 this is like 9/11 all over again,,”
So clueless.
I think it was a joke kind of?
Yeah? I guess it could be humorous sarcasm. Maybe.
I gave it a chuckle. I’m sure that’s how they really feel.
OGUSERS: WHAT CONNECTIONS DO YOU HAVE WITH AT&T AND/OR ITS EMPLOYEES/SYSTEM?
Probably TCP
The “Hi” part kills me. I know whenever I get a letter from a law firm it generally starts with “Hi” or sometimes “‘Sup?”
It’s reminiscent of how the robo-caller guys tell you they’re from the Social Security Administration and they’re sending “local cops to arrest you or take you to prison.”
Hi Bian,
I have read your article on ” Account Hijacking Forum OGusers Hacked”. The Article is really nice and interesting. Keep Writing.
Very nice article on Account Hacking Forums.
Great article, this was really enjoyable to read!