The Kodi Foundation Data Breach (2023): What Was Exposed & What To Do

In an era when online communities and open-source projects routinely hold large stores of member data, breaches that begin inside trusted accounts remain a persistent risk. The Kodi Foundation data breach reported in February 2023 fits this pattern: more than 400,000 user records were exposed after an administrator account was used to create and remove a database backup that later appeared for sale on a hacking forum.

The incident matters because the exposed material included identifiers and credentials that can be reused for further targeting. Public detail is limited to what has been reported, yet the scale and the types of data involved make clear why affected people and the organisation itself needed to treat the event seriously.

What happened

According to the reported account, in February 2023 The Kodi Foundation suffered a data breach that exposed more than 400,000 user records. The activity was attributed to an account belonging to “a trusted but currently inactive member of the forum admin team.” That administrator account created a database backup; the backup was subsequently downloaded and later sold on a hacking forum. The breach was reported on 16 February 2023. The Kodi Foundation elected to self-submit the impacted email addresses to Have I Been Pwned so that people could check whether their addresses appeared in the exposed set.

Reported data elements included email addresses, IP addresses, usernames, genders, and passwords stored as MyBB salted hashes. Additional data types named in connection with the incident are browser user-agent details, dates of birth, and private messages. No further public detail has been supplied on the precise technical path by which the backup left the organisation’s control, nor on any independent forensic timeline beyond the February 2023 reporting window.

How a breach like this happens

Incidents of this type typically begin with legitimate privileged access rather than an external remote exploit. An administrator or other high-privilege account—whether still active or long inactive—retains the ability to generate full database exports. Once a backup file exists, it can be copied off the system by anyone who controls that account or who later obtains its credentials. The file may then be offered on underground forums, where buyers seek bulk collections of emails, hashed passwords, and other personal fields.

Common contributing factors include unused but still-valid admin accounts, insufficient monitoring of bulk export actions, and the long-term retention of password hashes even when they are salted. Attackers or opportunistic insiders do not always need to break encryption at the moment of theft; they simply obtain the packaged data and leave the cracking or reuse of credentials to later stages. Organisations that discover such an event often respond by forcing password resets, reviewing admin privileges, and notifying affected users or breach-notification services—steps that align with the self-submission to Have I Been Pwned described in this case. No specific external threat group has been publicly attributed to the Kodi Foundation incident.

The Kodi Foundation and its sector

The Kodi Foundation supports the Kodi media-centre software, an open-source project used by a large international community to organise and play digital media. Like many open-source foundations, it maintains forums, user accounts, and related community infrastructure. Those systems ordinarily hold registration details, login credentials, messaging history, and technical metadata generated by browsers and network connections.

A breach affecting a project of this kind is consequential because the user base is both large and geographically dispersed. Members may reuse the same email address and password across other services; private messages and profile data can reveal personal habits or contacts; and IP addresses or user-agent strings can assist in further profiling. The foundation’s decision to push the affected emails into a public breach-notification service reflects an attempt to give users a practical way to discover exposure without waiting for individual outreach that may never reach everyone.

The information in question

The facts name the following categories as exposed: browser user-agent details, dates of birth, email addresses, IP addresses, passwords, private messages, and usernames. The reported summary additionally notes genders and states that the passwords were stored as MyBB salted hashes. Exact file sizes, full database schemas, and any other fields that may have been present are not publicly detailed.

Organisations that run community forums commonly hold precisely these kinds of records—account identifiers, contact emails, hashed credentials, demographic fields, message content, and connection metadata. In this incident the precise contents beyond the named types remain unconfirmed in public reporting; readers should treat only the listed categories as established.

Why it matters

For individuals, the combination of email addresses and passwords (even when salted and hashed) creates a concrete risk of credential-stuffing attacks against other sites where the same password was reused. Dates of birth, usernames, and private messages can support social-engineering or identity-related misuse. IP addresses and browser user-agent strings add technical context that can help an adversary recognise returning devices or approximate location. None of these outcomes is guaranteed, yet the volume—more than 400,000 records—means a large number of people face at least some elevated residual risk until they change reused passwords and monitor accounts.

For the organisation, the incident damages trust among community members, requires operational effort to rotate credentials and review admin access, and may attract regulatory or reputational scrutiny depending on jurisdiction. Self-reporting the emails to a widely used breach-notification service is a mitigating step, but it does not erase the underlying exposure of the other data types.

Were you affected?

If you ever registered an account on Kodi Foundation forums or related community services, treat the possibility of exposure as real. Change any password that may have been reused elsewhere, enable multi-factor authentication where available, and watch for unexpected login attempts or targeted messages that appear to draw on private forum content. Because The Kodi Foundation submitted impacted addresses to Have I Been Pwned, you can also run a free exposure scan of your email address against known breach data to see whether it appears in this or other incidents. Remaining alert to phishing and avoiding password reuse remain the most practical immediate defences.

AICompiled with AI assistance from public sources and published under our editorial standards.