Kodi has confirmed that a dump of the Kodi user forum is out for sale. They were using MyBB for their user forums.
An admin account was somehow compromised and MyBB allows DB backup through ACP. Probably this was used to access the database.
QuoteThe nightly full backups that were downloaded expose all public forum posts, all team forum posts, all messages sent through the user-to-user messaging system, and user data including forum username, email address used for notifications, and an encrypted (hashed and salted) password generated by the MyBB (v1.8.27) software. At the current time, we have found no evidence of unauthorised access to the underlying server that hosts the MyBB software.
