OGUsers (2022 breach) Data Breach (2022)

On July 13, 2022, OGUsers appeared in a fresh data breach notification on Have I Been Pwned, confirming that 529,000 unique email addresses tied to the notorious account-hijacking and SIM-swapping forum had been exposed. Anyone who maintained an account on the site — or whose credentials were reused from elsewhere — is now at direct risk. The breach, the fifth suffered by OGUsers since December 2018, includes usernames, email addresses, IP addresses, and passwords stored as Argon2 hashes.

Confirmed Breach Details

The primary disclosure on Have I Been Pwned states that the compromised dataset contains usernames, email addresses, IP addresses, and Argon2-hashed passwords. It does not specify how the attackers initially gained access or whether plaintext passwords were obtainable. The listing makes clear this is the latest in a repeated series of breaches for the forum, which has been targeted regularly since late 2018. No ransom demand or extortion leak-site posting is referenced in the notification.

Why This Matters for You and Your Family

If you or anyone in your household ever registered on OGUsers, even years ago, your email address, username, and hashed password are now public. 529K unique emails means the exposure touches a wide range of individuals who may have used the same credentials on banking, email, or shopping sites. IP addresses in the dump can be correlated with geolocation data, making it easier for criminals to tie online handles to physical locations. For families this risk extends beyond the original account holder: children or spouses who share devices or password patterns can be pulled into the same compromise chain.

Doxxing and Identity-Chain Risks

OGUsers has long served as a marketplace for stolen identities, SIM-swapping tools, and doxxing services. Data from this breach therefore feeds directly into the very ecosystem it once supported. A username and email pair can be cross-referenced against gaming platforms, social media, and data-broker records to build a complete identity profile. Once attackers link your email to a Discord tag, Roblox account, or Fortnite username, they can pivot to social engineering or credential-stuffing attacks that expose your family’s photos, addresses, and financial details. Credential leaks of this type frequently cascade into account takeovers precisely because users reuse passwords across both shady forums and everyday services.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to scrub what you can.
• Rotate the password used on OGUsers anywhere it has been reused and switch to a unique passphrase for every important account.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same email or address found in breaches like this.
• Let remediation specialists handle persistent data-broker listings and takedown requests that surface from the OGUsers dump.

The incident underscores a simple truth: once your details appear in a breach tied to cybercrime communities, the exposure rarely stops at one site. Start your DoxxScan trial today and put continuous monitoring, identity-chain mapping, and hands-on remediation specialists between your family and the next wave of opportunistic attackers. DoxxScan is also effective for protecting gaming accounts because credential leaks like this one routinely cascade into account takeovers and doxxing chains that begin with a single forum breach.