Breach Report: Kodi media center forum breach by BreachForums\Amius affects 400k

(image source: Kodi, n.d.)

One-sentence summary:

Kodi media center community forum from the Kodi Foundation was breached in February, and the data posted for sale on BreachForums by Amius, affecting over 400,000+ forum members.

Who was involved?

Kodi media center forums, Kodi Foundation, 400,000+ forum members, and BreachForums\Amius.

What was the timeline?

February 16 & 21, 2023: BreachForums\Amius accesses Kodi MyBB admin account and makes backups to presumably exfiltrate forum data

February 16 (approx.) 2023: Threat actor Amius posts the data for sale on BreachForums

April 8, 2023: Kodi Foundation becomes aware of the data for sale and posts a public notice after taking the forum offline

April 11, 2023: Kodi Foundation posts forum backups on their website

What occurred?

In February 2023, a member of BreachForums (Amius) breached a Kodi’s MyBB admin account and made MyBB backups from the admin console to exfiltrate the forum’s data (Toulas, 2023). Over 400,000+ members’ information was potentially breached, including private messages, email addresses, and hashed (and salted) passwords (Toulas, 2023; Kodi, 2023). The forum has been taken offline for several days to be updated, with backups now made available (Kodi, 2023). Kodi is also planning on initiating a site-wide password reset with advanced security measures listed below under “Lessons Learned” (Toulas, 2023)

Estimated costs:

Associated incident response costs, forum downtime (although Kodi is open-source and the Kodi Foundation is a U.S. non-profit)

Involved laws:

Federal/Regional: GDPR (per Kodi)

Root cause:

Inactive admin account compromise (though no information is given as to how the compromise occurred)

Lessons learned:

Per Kodi: “restrict and harden access to the MyBB admin console, revise admin roles to reduce privileges wherever possible, and improve audit logging and backup processes” and “formal penetration testing”

Sources:

Kodi. (n.d.). thumbnail-light.webp. Kodi.tv. https://kodi.tv/images/blog/thumbnail-light.webp

Kodi. (2023, April 11). IMPORTANT: Kodi Forum – Data Breach | News. Retrieved April 14, 2023, from https://kodi.tv/article/important-kodi-forum-data-breach/

Toulas, B. (2023, April 12). Kodi discloses data breach after forum database for sale online. BleepingComputer. https://www.bleepingcomputer.com/news/security/kodi-discloses-data-breach-after-forum-database-for-sale-online/

Commentary:

While Kodi refers to its password storage technique as encryption, this is a misnomer. Hashing and salting is a cryptographic password technique. Hashes can be broken, are a one-way function, and don’t require an encryption/decryption key (see John the Ripper).

About Post Author

Kyler Kent CISSP

Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike’s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation—turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master’s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect – Professional, AWS Security – Specialty, and multiple CrowdStrike credentials. He writes to close the gap between “what the textbook says” and what analysts actually do on shift with his published book: "SOC Analyst Career Guide" (ISBN-13: 9781835467466). https://linktr.ee/kentprotect.com Corrections: [email protected]

http://kylerkent.com