Kodi recently confirmed a data breach after unknown threat actors stole the company's MyBB forum database. The database contained user data and private messages. The threat actors attempted to sell the data dump, which contained 400,635 Kodi users, on the now-defunct BreachForums cybercrime marketplace. Kodi said in an advisory that the account of a trusted but currently inactive member of the forum admin team was used to access the web-based MyBB admin console twice: on 16 February and again on 21 February. The threat actors then abused the account to create database backups that were then downloaded and deleted. Also downloaded were existing nightly full backups of the database. The account in question has now been disabled. The database backups contained all public forum posts, team forum posts, messages sent through the user-to-user messaging system, and user information such as forum username, email address used for notifications, and an encrypted (hashed and salted) password generated by the MyBB software. Kodi said there is no evidence threat actors managed to obtain unauthorized access to the underlying server hosting the MyBB software. It further emphasized that the legitimate account owner did not perform malicious actions on the admin console, suggesting credential theft.