Kodi Foundation Breach Exposes 400,635 User Accounts via Insider Admin Backup Theft
What Happened — In February 2023 an administrator‑level account on the Kodi Foundation forum was used to generate a full database backup. The backup file was downloaded by the admin and later sold on a hacking forum, leaking email addresses, IPs, usernames, dates of birth, passwords (MyBB salted hashes) and private messages belonging to over 400 k users.
Why It Matters for Trust & Control Assurance
- Highlights the need for strict privileged‑account management and continuous monitoring of admin actions – a core control‑area for any assurance program.
- Demonstrates how inadequate backup handling and lack of segregation of duties can create insider‑threat exposure, undermining defensible audit evidence.
- Directly maps to the Access Controls capability, where continuous verification of who can create, download, or export sensitive data is essential.
Who Is Affected — Media & entertainment platforms, open‑source community sites, and any service that stores user credentials and personal data.
Recommended Actions
- Enforce MFA and least‑privilege principles for all admin and privileged accounts.
- Implement immutable logging and real‑time alerts for backup creation, export, and download activities.
- Rotate credentials for privileged accounts regularly and conduct periodic access‑review audits.
- Store passwords using modern, adaptive‑hashing algorithms (e.g., Argon2) and consider password‑less authentication where feasible.
- Document the incident response workflow and retain evidence to satisfy audit‑readiness requirements.
Technical Notes
- Attack vector: Insider misuse of a trusted admin account (no external exploit).
- Data types exposed: Email addresses, IP addresses, usernames, dates of birth, passwords (MyBB salted hashes), private messages.
- No public CVE; breach was self‑reported to Have I Been Pwned (HIBP).