KiwiFarms Forum Breach Exposes 4,606 User Emails, IPs, and Birthdates
What Happened – In September 2019 the KiwiFarms discussion forum suffered a data breach that publicly disclosed email addresses, IP addresses, dates of birth, avatars and site‑activity details for 4,606 registered accounts.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of inadequate data‑handling controls and the need for continuous evidence that personal information is protected.
- Highlights the importance of a privacy‑focused control‑assurance program that can prove consent, data minimisation, and secure storage to auditors.
- Aligns directly with Verisq’s CookiePLUS privacy capability, which helps organisations capture consent, manage data‑subject requests and maintain defensible audit trails.
Who Is Affected – Online community platforms, media‑focused forums, and any service that stores personally identifiable information (PII).
Recommended Actions
- Map the exposed data categories to your privacy control objectives (e.g., consent management, data minimisation).
- Collect and retain evidence of encryption, access logs, and consent records to demonstrate due diligence.
- Conduct a rapid privacy impact assessment and update incident‑response playbooks to include PII breach reporting.
Technical Notes – The breach details were disclosed via Have I Been Pwned; no specific vulnerability or attack vector was identified in public sources. Source: https://haveibeenpwned.com/api/v3/breach/KiwiFarms