Citation :It was not the software itself that was hacked, as many tend to assume automatically. The owner of Mybb, Chris, domain registrar account was hacked which gave them access to redirect the domain to the page you all see. The do have access to the servers as well, but again it was a matter of getting his login information and not through MyBB the software.

Citation :Lesson learnt: Do not use iCloud. If your account is compromised, your iPhone can be remotely wiped.

Tim B. a écrit :There are still a few missing pieces, but at this stage we have a pretty clear understanding of what happened. Contrary to what has been posted elsewhere, we do not believe social engineering was the culprit, although the hackers did try unsuccessfully to gain access to several of our accounts via this method.

The main incident that lead to the breach was a compromise of Chris’ personal Apple ID (iCloud, etc) account. From there, the hackers were able to reset passwords to our hosting and domain accounts. It’s still not clear how they got access to this account, however they also had numerous personal details about Chris, including contact details and knowledge of at least the last four numbers of his primary credit card.

Fortunately SoftLayer (our host) called Chris when his password was reset which alerted us to the situation unfolding and all public access to the server was shut off soon thereafter. As far we can tell they were not able to log into our server and do not have copies of our databases. We have been very pleased by the response we received from SoftLayer and without their vigilance the situation could have been far worse.