Fanlore Data Breach Exposes 145K Email Addresses and Hashed Passwords
Earlier this month, Fanlore a wiki platform focused on fandom and pop culture suffered a data breach compromising 145,000 unique email addresses, along with usernames and passwords. The exposed passwords were stored as MD5 or PBKDF2 hashes, with weaker MD5 hashes posing a higher risk of decryption.
Security researchers noted that 23% of the leaked email addresses had already appeared in previous breaches, including the 2021 LinkedIn data exposure. The incident highlights persistent vulnerabilities in password storage practices, particularly the continued use of outdated hashing algorithms like MD5.
While the breach’s exact cause remains undisclosed, the exposure underscores the ongoing risks of credential reuse and the need for stronger security measures in user data protection. The compromised data has been added to breach notification services for affected individuals to assess their exposure.
Source: https://www.linkedin.com/feed/update/urn:li:activity:7495664395423838208
Organization for Transformative Works cybersecurity rating report: https://www.rankiteo.com/company/organization-for-transformative-works
"id": "ORG1787113637",
"linkid": "organization-for-transformative-works",
"type": "Breach",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '145,000',
'industry': 'Media/Entertainment (Fandom/Pop Culture)',
'name': 'Fanlore',
'type': 'Wiki Platform'}],
'data_breach': {'data_encryption': 'MD5 or PBKDF2 hashes (MD5 considered '
'weak)',
'number_of_records_exposed': '145,000',
'personally_identifiable_information': 'Email addresses, '
'usernames',
'sensitivity_of_data': 'High (personally identifiable '
'information and authentication '
'credentials)',
'type_of_data_compromised': ['Email addresses',
'Usernames',
'Password hashes']},
'description': 'Fanlore, a wiki platform focused on fandom and pop culture, '
'suffered a data breach compromising 145,000 unique email '
'addresses, along with usernames and passwords. The exposed '
'passwords were stored as MD5 or PBKDF2 hashes, with weaker '
'MD5 hashes posing a higher risk of decryption. 23% of the '
'leaked email addresses had already appeared in previous '
'breaches, including the 2021 LinkedIn data exposure.',
'impact': {'data_compromised': '145,000 unique email addresses, usernames, '
'and hashed passwords',
'identity_theft_risk': 'High (due to exposed email addresses and '
'weak password hashes)'},
'lessons_learned': 'Persistent vulnerabilities in password storage practices, '
'particularly the continued use of outdated hashing '
'algorithms like MD5. Risks of credential reuse '
'highlighted.',
'post_incident_analysis': {'root_causes': 'Outdated password hashing (MD5), '
'potential credential reuse from '
'prior breaches'},
'recommendations': 'Adopt stronger password hashing algorithms (e.g., bcrypt, '
'Argon2), enforce multi-factor authentication, and educate '
'users on credential hygiene.',
'references': [{'source': 'Breach notification services'}],
'title': 'Fanlore Data Breach Exposes 145K Email Addresses and Hashed '
'Passwords',
'type': 'Data Breach',
'vulnerability_exploited': 'Outdated hashing algorithms (MD5)'}