Data on 400K Kodi Forum Members Stolen and Put Up for Sale

Open source media player Kodi still hasn't recovered its forum and plans to redeploy it on a new server with software update.

Dark Reading Staff, Dark Reading

April 12, 2023

1 Min Read
an image of a digital home theater system.
Source: Panther Media GmbH via Alamy Stock Photo

The Kodi forum (MyBB) is a place where about 400,000 users of the Kodi open source media player come together to share tips on customizing their home theater experience. But when a cache of MyBB user data popped up for sale on an Internet forum, team Kodi took a closer look and realized there had been a major breach.

Logs revealed that a former MyBB admin's account was hijacked to access the admin console on both Feb. 16 and Feb. 21, the Kodi Foundation said in a statement announcing the breach on April 8.

"The account was used to create database backups which were then downloaded and deleted. It also downloaded existing nightly full-backups of the database," the Kodi statement said.

That means all public forum posts, team forum posts, user-to-user messages, and user data, including username, email address, and hashed passwords were compromised, Kodi added.

An April 11 update on the breach by the Kodi Foundation said the forums were being migrated to new servers and will run on an updated version of MyBB software, and the forums will remain offline for several days during the migration.

"As part of the redeployment we will restrict and harden access to the MyBB admin console, revise admin roles to reduce privileges wherever possible, and improve audit logging and backup processes," the statement added.

In the meantime, Kodi Foundation has shared breach data with the haveibeenpwned disclosure site and vowed to share password reset information as soon as the forums are back up. Additionally, the forum wiki is being moved to a new host, the statement added.

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights