OpenSubtitles hacking attack, 7 million records were leaked

A popular platform for movie and series lovers the opensubtitles.org is nothing new on the internet, as it provides fan-created subtitles in many languages for download. However, it has been reported that there was a successful hacker attack on the repository in mid-2021.

OpenSubtitles is quite notorious among movie and series fans because the portal offers so-called SRTs. These can be added to videos and are suitable, among other things, for watching and, above all, understanding films in their original language.

Through OpenSubtitles, millions of subtitle files are downloaded week after week, it is certainly not a big secret that these downloads are usually used for illegally obtained videos. As TorrentFreak reports, the site was founded in 2006 by a Slovak programmer, and since then it’s hard to imagine the scene without it. Admittedly: OpenSubtitles and the subtitles themselves are not yet copyright infringement, because they are usually generated by users themselves.

Attack was conducted months ago

But now OpenSubtitles has a serious problem. Because, as they recently revealed with some delay, the site was hacked in August 2021. The attacker(s) were able to capture a wide-ranging data set, including email and IP addresses, usernames as well as passwords.

In a forum post, OpenSubtitles writes, “In August 2021, we received a message on Telegram from a hacker who provided us with evidence that he had gained access to opensubtitles.org’s user table and downloaded an SQL dump of it. He demanded a bitcoin ransom not to make this public and promised to delete the data.”
The site operators agreed, even though the ransom was anything but small. As a result, the hacker also revealed how he was able to gain access and helped those responsible at OpenSubtitles to fix the bug.

The matter seemed to be out of the world, but recently OpenSubtitles was contacted again, by an “associate of the original hacker”. The latter made similar claims and a few days ago the data was then leaked. Affected users have already been informed, and the matter is especially problematic for those who have or had the same user/password combination in use on other sites. They should visit Have I Been Pwned and check whether they are affected.