JoomlArt Data Breach (2018): What Was Exposed & What To Do

In January 2018, JoomlArt reported that more than 22,000 unique customer records had been inadvertently exposed through a Jira ticket. The records originated from iJoomla and JomSocial, two services the company had acquired the previous year, and contained usernames, email addresses, names, payment histories and passwords stored as MD5 hashes. JoomlArt stated it had already notified affected individuals once it became aware of the exposure. The incident was made public on 30 January 2018. No further technical details about the duration of the exposure or the precise configuration error have been released.

Inside the incident

The exposure occurred when customer records from the acquired platforms appeared in a Jira ticket that was accessible beyond its intended audience. The dataset included 22,000 unique entries. Passwords were present only in MD5-hashed form. JoomlArt confirmed awareness of the incident and said it had already contacted the individuals whose information was involved. No additional counts, file listings or timelines beyond the January 2018 reporting date have been disclosed.

How a breach like this happens

Incidents of this type often stem from misconfigured access controls on internal tools such as ticketing or project-management systems. When a support or development platform is left reachable without authentication, or when records are copied into tickets for troubleshooting, data that would normally remain internal can become visible to anyone who locates the link. Such exposures are typically discovered by external researchers scanning public internet-facing services rather than by deliberate intrusion.

Who is JoomlArt?

JoomlArt operates a website that supplies templates and extensions for the Joomla content-management system. In 2017 it acquired iJoomla and JomSocial, both of which maintained their own user bases. Organisations in this sector routinely hold account credentials, purchase histories and contact details for customers who buy or register for extensions and templates. A breach at such a provider can affect downstream website operators who rely on those services.

What was likely exposed

The records named in the incident included usernames, email addresses, names, payment histories and passwords stored as MD5 hashes. It is not confirmed whether additional fields such as physical addresses, IP logs or full transaction details were also present. Because the exact contents of every record remain undisclosed, the full scope of personal or financial information cannot be stated with certainty.

What's at stake

Individuals whose email addresses and hashed passwords were exposed face the possibility that accounts on other sites could be targeted if the same credentials or weak hashing methods are reused. Payment histories, even without full card numbers, can reveal spending patterns that some users prefer to keep private. For the organisation, the event underscores the need to audit data-handling practices after acquisitions and to verify that internal systems do not inadvertently publish customer information.

What to do if you're exposed

Change passwords on any accounts that used the same credentials, and enable multi-factor authentication where available. Review recent transactions for any signs of unauthorised activity. Readers can run a free exposure scan of their email address against known breach data to determine whether their information appears in this or other documented incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.