Hi all OpenSubtitles users,
What happened
We have some bad news... we have been hacked.
In August 2021 we received message on Telegram from a hacker, who showed us proof that he could gain access to the user table of opensubtitles.org, and downloaded a SQL dump from it.
He asked for a BTC ransom to not disclose this to public and promise to delete the data.
We hardly agreed, because it was not low amount of money. He explained us how he could gain access, and helped us fix the error. On the technical side, he was able to hack the low security password of a SuperAdmin, and gained access to an unsecured script, which was available only for SuperAdmins. This script allowed him to perform SQL injections and extract the data.
He gained access to all users data - email, username, password...He promised the data would be erased and he would help us secure the site after the payment.
The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt
It means, if you used strong password (lets say at least 10 characters with lowercase, uppercase, number and special characters) you should be safe, but short easy passwords, specially if they are in the english dictionary can rather easily be extracted from these data.
Most users didn't use these strong passwords, it means, hacker can get access to user accounts. So he can download subtitles and so on, he didn't gain access to any credit card data or so - these are stored outside of our platform.
What you should do
- change opensubtitles.org and opensubtitles.com and forum password (we are requesting this)
- if you used opensubtitles.org password somewhere else, change it as well, specially important for emails and services where you have any payments and personal details
forum.opensubtitles.org