Security News > 2023 > April > Kodi Confirms Data Breach: 400K User Records and Private Messages Stolen
Open source media player software provider Kodi has confirmed a data breach after threat actors stole the company's MyBB forum database containing user data and private messages.
What's more, the unknown threat actors attempted to sell the data dump comprising 400,635 Kodi users on the now-defunct BreachForums cybercrime marketplace.
"MyBB admin logs show the account of a trusted but currently inactive member of the forum admin team was used to access the web-based MyBB admin console twice: on 16 February and again on 21 February," Kodi said in an advisory.
The nightly backups contained all public forum posts, team forum posts, messages sent through the user-to-user messaging system, and user information such as forum username, email address used for notifications, and an encrypted password generated by the MyBB software.
In the interim, the company has taken down the Kodi forum and noted that it's in the process of commissioning a new server, an activity that's expected to last "Several days." It's also planning to redeploy the forum on the latest version of MyBB software.
As additional security measures, Kodi is hardening access to the MyBB admin console, revising admin roles to limit privileges, and improving audit logging and backup processes.
News URL
https://thehackernews.com/2023/04/kodi-confirms-data-breach-400k-user.html
Related news
- Yacht retailer MarineMax discloses data breach after cyberattack (source)
- OWASP discloses data breach caused by wiki misconfiguration (source)
- AT&T faces lawsuits over data breach affecting 73 million customers (source)
- SurveyLama data breach exposes info of 4.4 million users (source)
- US cancer center data breach exposes info of 827,000 patients (source)
- Home Depot confirms third-party data breach exposed employee info (source)
- AT&T now says data breach impacted 51 million customers (source)
- CISA warns about Sisense data breach (source)
- Hacker claims Giant Tiger data breach, leaks 2.8M records online (source)
- Cisco Duo warns third-party data breach exposed SMS MFA logs (source)