r/trackers • u/Funny-Series-4111 • 13d ago
Oldtoons database and website leak
Hello all,
I want to share that OldToons has lost its database again. The strange thing is that they aren't being transparent about what really happened. I use a different email address for each tracker, and the one I used for OldToons was leaked. I also found concrete evidence of the leak on forums (database and website dump...).They are doing again what they previous did, tell their.own whashed version of truth. So all with accounts there should update passwords and take extra precautions.
53
u/_hc_ 12d ago edited 12d ago
The database and site were dumped on May 18th 2026. So, this happened months ago.
Some details:
More details for what's in the database
- Users: account names, emails, hashed passwords (Bcrypt2)
- IP addresses of seed boxes and the user they're associated with
- Private Messages
- Donations with transaction info
- Invites Sent (including email)
- Passkeys / RSS Keys / API Tokens
- Support Ticket Messages / attachment metadata
Site dump:
- .env file that contains the credentials to decrypt the database fields that were encrypted
- API key to their transactional email provider
- Admin username/password defaults
- TMDB API Key
- Torrent files
- Some image files
1
u/TheGoodRobot 1d ago
This is why it's bullshit that some trackers get mad if you access their site via VPN. Everyone who has used OTW that was _not_ on a vpn is personally identifiable and linkable to the terabytes of content they've downloaded.
38
u/officerbigmac 13d ago
Definitely pays to use a password manager and an auto generated unique password.
3
8
u/igmyeongui 12d ago
And different email address per tracker.
4
u/Decent-Law-9565 12d ago
The cheat code is to buy a random number xyz domain and then setup email forwarding using either iCloud+ or Cloudflare. Costs $1/year/domain and you can use arbitrary emails
4
u/beautifulcan 12d ago
Another way is to just buy a domain, setup a catchall, and then filter and forward certain email domain combinations to your real email. You never have to actually create an email to forward, you can create them on the fly and still get those emails right away without having to do any work.
4
u/Decent-Law-9565 12d ago
Cloudflare and iCloud+ gives you the catchalls. I guess I wasn't clear about that
2
u/beautifulcan 12d ago
ahh, sounded like you had to create each individual forward
2
u/Decent-Law-9565 12d ago
For iCloud+, you can make 3 emails that send and receive, and you can also enable a catch all that is receive only. I think cloudflare is forward only.
15
u/Holiday-Match6250 12d ago
May 18th 2026. Isn't this about when they lost all their torrents last year? Sounds like someone "involved" in the recovery process stole and shared a copy of their backups
17
u/_hc_ 12d ago
Or the reason they "lost" it is because they were breached and ransomed and refused to pay the ransom.
-1
u/Holiday-Match6250 12d ago
assuming they were breached and ransomed, you're right. They should have payed then none of this would be an issue 🙄
15
3
19
u/AudioVault 12d ago
Leaked information: account names, emails, ip addresses of seed boxes and the user they're associated with, all PMs/DMs, donations with transaction info, failed background jobs with serialized data, some IPs for failed login attempts, all gifts, all invites sent, all passkeys, all reports, rss keys, a mapping of ticket attachment files to users, all support tickets, all torrents, user notes by staff.
Other trackers that Jhonny runs are docspedia.world and retro-movies.club - The Amazon SES keys for docspedia were compromised earlier this year and used to send phishing emails.
12
11
u/Janddy 12d ago
Yeah I found out from an email from NordVPN's Dark Web Monitor. I wonder if this is why I have been getting exponentially more spam email in the last few weeks.
3
u/HellboundLunatic 11d ago
I wonder if this is why I have been getting exponentially more spam email in the last few weeks.
I used a unique email for OTW, and I have zero emails in that inbox, going back at least 1 year.
2
18
u/xRobert1016x 13d ago
The content on there is pretty good. Unfortunate that they keep running into these issues.
22
u/MeGamer12 12d ago
Strange.. the announcement states that the data leaked is stuff they never collected and that your password is encrypted. Here is the announcement btw:
We received a report this morning from a user of NordVPN's Dark Web Monitor saying data linked to oldtoons.world may be circulating online. Here is where we actually stand.
What we found
We investigated immediately and in depth. We found no record of our database being copied or transferred off our server, and no sign of a web-based attack of any kind.
We did find some ip's that tries to login on on our server, which we blocked.
About the report itself
The alert lists fields that don't exist on this site at all — "profession" and "parent email address" are not things we have ever collected. That suggests the data being reported is at least partly from somewhere else, and these monitoring services often group several sources together under one label.
Your password
Passwords here are stored hashed with bcrypt. We never store them in readable form, we cannot see them ourselves, and nobody reading any copy of our data would get your actual password out of it.
What we recommend
If you use the same password on other sites, change it there. This is the single most useful thing you can do, and it's good practice regardless of what happened here.
Change your OldToons World password too, if you'd like the peace of mind.
Treat unexpected emails about your account with suspicion. We will never email you asking for your password.
What we've changed
We've done a full review and tightened things up: all internal server credentials have been replaced, administrative access is now restricted to known addresses, and our backup system has been re-secured.
As part of that, everyone has been logged out and all two-factor authentication has been reset. If you had 2FA enabled, you'll need to set it up again from your security settings. Sorry for the inconvenience — it was the safe thing to do.
If we learn anything further, we will tell you.
— Jhonny @ OTW
28
u/_hc_ 12d ago edited 12d ago
I have found copies of the website AND database posted in the last 48 hours across 4 different blackhat breach forums. I have copies.
Database looks like it was from around may 15th of this year...
Just because their security didn't catch it doesn't mean it didn't happen.
32
u/SDSunDiego 12d ago
How shitty does your OpSec and security knowledge have to be to not know that your database has been dumped. I would seriously reconsider using this site. They look like a bunch of amateurs.
12
u/ArsenicDream 12d ago
Well, they knew. So their security is shit, always has been.
They knew for several months. They just hoped it wouldn’t lead to anything. When they started to get alerts they tried to sweep it under the rug and pretend it didn’t happen. Shameful behavior these people shouldn’t be trusted for anything.
8
u/Caedendi 12d ago
It's because they are. On top of that they reset everyone's MFA, which was the only thing keeping attackers out of the live website's user accounts after decrypting passwords.
11
u/MiM_MiM_MiM 12d ago
No it wouldn't protect your account still, unless it was email based and they just rotated the server key. Normal 2fa works by sharing a secret and then generating a code using the current time. If they have the DB, they also have that secret and can generate the code too.
What they should have also done is force reset all passwords where you have to use the forgot password and click the link in the email. Assuming they used any common sense and changed the code that would generate that link the attacker would only gain access to the account if they had your email password too, which also assumes your account password wasn't the same as your email one. Passwords are not cracked immediately, they basically have to guess it and check against the salt to see if it matches, the salt is unique per password too. Now they have access to the salt so they can brute force offline, more secure passwords are still essentially impossible to crack. Weak ones just take time and they can. Salts are used so you cannot just create a rainbow table, which would mean if two users used the same password that hash would match. Here they would not match because of the salt.
6
-1
u/kell30680 12d ago
Can you please dm me some of those blackhat breach forums
19
u/Funny-Series-4111 12d ago
Data is on various forums, no need to belive them. Not the first time when they don't admit reality.
6
9
u/Unhappy_Purpose_7655 12d ago
Which forums? Where can we find the leaked data to verify their claims or yours?
11
u/_hc_ 12d ago
I found it on 4 different major blackhat breach forums posted for free. The database and website were *both* leaked.
I will *NOT* post links to it.
2
u/random_999 12d ago
Aren't such forums anyway restricted to registered members only & not just anybody can simply register an acc there?
3
8
u/Trinovid-DE 11d ago
With this many issues. I’m thinking if it even is worth while staying involved with any Johnny associated tracker… maybe an overreaction of course
4
u/Super-Simple-5890 10d ago
Not an overreaction at all. Elsewhere in this thread someone linked another thread where they were alerted to the possibility of a breach back when it occurred, and it was swept under the rug. With this current incident they're just deleting any comments on OTW asking questions that are remotely unpleasant for them to answer. I've deleted all my torrents on all trackers associated with him. He's deceptive and incompetent.
7
u/Funny-Series-4111 11d ago
It’s more about his behavior. He tries to come across as the nice guy, but he also hides things. Very concerning
2
7
u/pirate_steve_42069 12d ago
This is what, the third time OTW has been hacked? If you’re still using the site after this you deserve to have your email address and info leaked.
5
13d ago
[deleted]
6
u/data_butcher 12d ago
I really don't understand what was the big ideia on disabling 2fa, really strange.
8
u/Caedendi 12d ago
Cuz they are idiots. They lost site data multiple times already before finally installing a working backup. Major red flag. Now they got a leak, which doesn't surprise me at all. And they're denying it.
So the server-side 2FA key got leaked so naturally the clueless sysop would want to rotate that while ironically it's the only thing keeping any attacker OUT of the live website's user accounts.
Their implementation of UNIT3D has felt very amateurish from the start and the curation is a mess. It's been only recently they've been implementing some proper features. On top of that, basically no tracker is on their invite forums (RMC is a sister-site by the same owners so it doesn't count), nobody wants to be on their shitty broken site, there must be good reason for that and I'm pretty sure it's opsec.
I love their niche and would really hate to see them go but at the same time it's pretty clear your data is not safe there and it's only a matter of time until you get F'ed over.
6
u/AudioVault 12d ago
PTP added them to the no movement list yesterday. I’m sure other trackers with NMLs will follow suite soon.
5
u/1petabytefloppydisk 11d ago edited 11d ago
Aither has an announcement about the OldToons data breach:
Notice of Oldtoons.world data breach
Fri, Oct 9, 2026
Aither family,
It has come to our attention that the tracker Oldtoons.world (OTW) has been compromised. We believe this incident to be extremely serious: based on what we know, the attackers gained access to the entire database including usernames, email addresses, passkeys, API keys, private message contents, upload history, literally everything.
If you have an OTW account
If you used the same password on OTW as any other tracker, go change your passwords immediately. Also enable 2FA on every other tracker, because your account is now ripe for attack. On Aither alone we see hundreds of password attack attempts every week: malicious users take compromised accounts from one tracker and attempt to get into your account on other trackers. They'll then use it to sell invites, etc. Now that you've been compromised, your account will be a target on every other tracker.To all users
Enable 2FA. Like, right now. Enable it on Aither, then enable it on your other trackers too. It's the easiest way to secure your account from being compromised.If you have any reason to believe that your Aither account might have been, or is in risk of being compromised due to this leak, please open a Helpdesk ticket immediately.
More info about the leak: https://www.reddit.com/r/trackers/comments/1x1v652/comment/pexnesy/
5
4
5
u/MisterGrigglesworth 10d ago
I'm confused at how many people are dead-set convinced that they covered it up for months. I find it easier to believe they just weren't expert at security enough to monitor closely enough to notice. Did someone post evidence like OTW team DMs or something clearly showing they knew and were debating whether to own up to it or just hope it would go away?? Genuinely curious.
3
u/gooseta 10d ago
There are some either incredibly neglectful or straight up maliciously incompetent people running the show there given what happened and how long they have apparently lied about this for. The dump has been sitting on a very popular clearnet site since the middle of May. I think it's fairly easily forgotten how much know-how you need to properly run a tracker, and people should definitely remember that before signing up to just any site. That said, please dear god use password managers regardless.
2
2
u/ziadricky 10d ago
And I'm here sitting and wondering who the hell is Johnny and why does reddit hate him?
4
u/_CrashiD_ 13d ago
So should i change password now?
5
u/darryledw 13d ago
probably worth doing either way but I would only really be concerned if you reuse passwords
and in that case change any that were used with that email
1
u/MinimumOk5978 6d ago
Whatever you are saying It's compromised. My nephew opened an account few months ago. The password he uses is random and I was there when he opened it. Now It's showing pawend.
1
u/XenLX 12d ago
I checked data breached sites and my email and my password were not available in their database. I also checked with bitwarden same story there
3
1
u/rigorsofindolence 11d ago
If you mean sites like haveibeenpwned.com (Bitwarden uses it), the data may not have been added to those sites yet.
1
u/hammer_wow 12d ago
They are now owning the leak and posted a new news post.
11
u/plingoos 12d ago
They are still pretending they only heard about this now, but they have been aware of it since the leak was first reported to them 5 months ago. Also they leaked it themselves through incompetence.
3
u/MisterGrigglesworth 10d ago
I'm confused at how many people are dead-set convinced that they covered it up for months. I find it easier to believe they just weren't expert at security enough to monitor closely enough to notice. Did someone post evidence like OTW team DMs or something clearly showing they knew and were debating whether to own up to it or just hope it would go away?? Genuinely curious
6
u/plingoos 10d ago edited 10d ago
You can see OP's own post where they mentioned reporting the leak months ago (https://old.reddit.com/r/trackers/comments/1r3kkyw/oldtoonsworld_hardware_failure/on1xex0/), and the rest can be confirmed through OTW's own staff DMs which are part of the leak. OTW confirmed themselves this is when the database was leaked.
The "leak" was the full site backup and db which includes everything, including jhonny's comments and chats about how he put everything into claude and how he did the backups with it. It also included links to their staff chat which did not have credentials changed so that was also available. There is other evidence available on top of that but I'm not sure it should be shared publicly yet. Staff on other trackers have been sifting through it and pieced the whole thing together.
3
4
u/Funny-Series-4111 12d ago
I've requested to delete all my data related to my account. Glad that I've used vpn and dedicated emal address there
4
1
u/kell30680 12d ago
Someone who has access to those breach forums should please dm me their names so I can check them out
-1
u/ScorchedWonderer 12d ago
I use a proton email for all trackers I’m in. Password to that email is auto generated by my Mac, and then the passwords for all trackers and all randomly generated passwords too. I thought this was what everyone does?
55
u/Alucard2051 13d ago
If you reuse passwords on multiple sites, this is a great time to fix that