The Kodi Foundation Data Breach (2023)

On February 16, 2023, the Kodi Foundation notified Have I Been Pwned that an administrator account belonging to a trusted but currently inactive member of its forum admin team had created and exfiltrated a database backup containing more than 401,000 user records. The breach exposed email addresses, usernames, passwords stored as MyBB salted hashes, dates of birth, IP addresses, browser user agent details, genders, and private messages.

Reported Details from the Disclosure

The official entry on Have I Been Pwned states that the incident occurred in February 2023 and that the Kodi Foundation itself submitted the list of impacted email addresses. The disclosure indicates the breach originated from an internal administrator account that generated a full database backup, which was then downloaded and later sold on a hacking forum. The notification does not specify the exact date the backup was taken or the precise number of records sold, only that more than 400,000 users were affected. Passwords were stored as salted MyBB hashes, a detail that limits but does not eliminate the risk of offline cracking.

Why This Matters for You and Your Family

If you or anyone in your household ever created a Kodi forum account, your email address, username, date of birth, IP address, and password hash are now in circulation. Passwords and dates of birth are particularly dangerous because they often get reused across banking, shopping, and government sites. An exposed IP address combined with a date of birth can quickly narrow down your real-world identity, especially if you posted in the forums. Even if you have not used the account in years, the data remains valuable to identity thieves who combine it with other leaks.

Private messages may contain personal conversations that, when paired with an email address or username, can be used for targeted social engineering against you or your family members.

The Doxxing and Identity-Chain Risks

Once an email and password hash from the Kodi Foundation breach reach underground markets, attackers begin building identity chains. They test the credentials on other services, link your forum username to gaming handles or social-media profiles, and map the IP address to a geographic area. This process frequently cascades into account takeovers, especially on gaming platforms where children share the same household email or password patterns. Doxxing chains often start with exactly this mix of email, date of birth, and password data, then expand to expose home addresses, phone numbers, and family relationships.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate the password you used on the Kodi forums anywhere it has been reused and enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same email or address.
• Let the remediation specialists perform takedown requests across data brokers and leak sites on your behalf.

The Kodi Foundation breach illustrates how even long-dormant forum accounts can suddenly expose your family to fresh risks years later. A single administrator mistake turned into a permanent addition to the underground data economy. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts where credential leaks like this one frequently lead to takeovers and doxxing chains. Starting proactive protection now limits how far attackers can travel with the Kodi data.