Hackers clash over Doxbin lost account access

Cyberdrama was unleashed after attackers claimed they had breached the notorious personal data dumpsite Doxbin.

The notorious Doxbin site, a repository of information for potential swatting targets, has reportedly been breached. The malware and cybersecurity informant vx-underground claims that the cybergang Tooda was responsible for the compromise.

Tensions between Doxbin admins and Tooda members first escalated, as one of Doxbin members was called a pedophile, reports claim.

Doxbin’s attack hints at irony as threat actors use the platform to leak personal data – a practice known as doxxing, which involves publicly sharing personally identifiable information such as names, addresses, and other details that help identify the target.

Moments ago Doxbin was compromised.

A group named undefinedToodaundefined has taken credit for the compromise.

In summary, administrative staff from Doxbin got into a verbal altercation with members of Tooda. Doxbin administration accused a Tooda member of being a pedophile.

Tooda retaliated… pic.twitter.com/aTIDodUfva

undefined vx-underground (@vxunderground) February 12, 2025

Tooda members allegedly wiped every account, making the site unusable for existing users. The cybergang also threatened to release the dumped details of Doxbin users. The dataset is believed to contain roughly 136,000 emails and usernames on Doxbin.

To tighten their grip, they allegedly locked administrative accounts, blocking site operators from regaining access.

Tooda’s crew also claim to have exposed personal details of Doxbin’s administrators and, most controversially, they released a so-called "blacklist" – a list of people who had supposedly paid to keep their information off the site, undoing their attempts to stay anonymous.

Updates to the Doxbin compromise:

tl;dr tl;dr entire conflict is the result of two people fighting over losing access to accounts (?)

We received a notification from a disposable e-mail notifying us of a message from yet another disposable alias undefinedPunchMadeHacksundefined (?)

In…

undefined vx-underground (@vxunderground) February 12, 2025

Vx-underground’s sources later revealed that attackers may have boasted too much. According to the source, the site was not actually compromised.

Instead, Tooda had only managed to gain access to the credentials of the Doxbin admins. They asserted that the information on the blacklist was already circulating before the so-called compromise, and details about the user base had also been leaked.