Serious concern: Why were XenForo customers never informed about this alleged internal data leak?

[Blatchy]

If it's true

There is no "if" no "alleged" this was all revealed in discovery..

Discovery is an early stage of a lawsuit where attorneys gather and exchange information to understand the facts and develop a strategy. The purpose of discovery is to promote fair access to information for all involved.

So that leaves 2 options..

1. A data breach (which seemingly is not the case)

or

2. A employee with access to high level information.

I will give them the benefit of the doubt when they say that this was the first they heard of such insider. But they certainly know who it is now.

 

[frm]

Did you actually read the filing because you have been blindly throwing darts and moving goalposts.

Took a while, but it appears they had already investigated Tattle Life to gather enough pieces of the puzzle. XenForo* merely filled in the blanks (or confirmed what they already knew) before a court order, less the purchase dates, etc.

Was it mishandled? Maybe. I believe that maybe is still in a grey area, though. Discovery alone, in this case, with what's provided at least, won't tell us whether they mishandled it or not. The only tell would be if Tattle Life pursued a suit against XenForo, or if XenForo admitted to it, and it being an un/authorized breach, and under what circumstances.

Despite that, they still got the NPO, presumably so the case would stick, as it probably wouldn't go over the goal post without the NPO to see what we're seeing today.

But, again, if you're so appalled by this, or running a forum that can be seen as nefarious/illegal, there's always this clause:

You may terminate the License at any time by uninstalling the Software and destroying all copies of the Software.

Since, again,

XenForo Limited reserves the right to modify the terms of this Agreement at any time.

Then, you can rest well at night knowing you have full anonymity.

* Edit: * When referring to "XenForo", I mean the legal entity, but it goes back and forth between the entity and the Source of the information, as that source can have acted on their own. So, this can be confusing to read.

 

[Jake B.]

Took a while, but it appears they had already investigated Tattle Life to gather enough pieces of the puzzle

I must ask, who do you think “they” is in this circumstance? This is not law enforcement doing some investigation.

 

[frm]

I must ask, who do you think “they” is in this circumstance?

NEIL SANDS and DONNA SANDS, through investigative means (be it legal or private detective work, hired or on their own), and Nardello & Co LLP.

 

[Jake B.]

NEIL SANDS and DONNA SANDS, through investigative means (be it legal or private detective work, hired or on their own).

Okay so you’re okay with a company giving personal details of an individual to a random private individual with no court order? I just need to make sure we’re on the same page.

 

[frm]

Okay so you’re okay with a company giving personal details of an individual to a random private individual with no court order? I just need to make sure we’re on the same page.

If a reasonable person can find that what they're doing is so egregious, yes. Does defamation of one person fit the bill? Probably not, unless it affects their livelihoods to an extreme without outright proof, which it most likely did, for them to retain a private investigator beforehand.

Something like hosting CSAM (and the private individual being a victim of it)? No doubt.

 

[Jake B.]

If a reasonable person can find that what they're doing is so egregious, yes. Does defamation of one person fit the bill? Probably not, unless it affects their livelihoods to an extreme without outright proof.

Something like hosting CSAM? No doubt.

Privacy laws exist, “confidential source” at XenForo is not a judge or court.

 

[frm]

Privacy laws exist, “confidential source” at XenForo is not a judge or court.

That point is made moot after the NPO. And, I'll lean back on this:

The only tell would be if Tattle Life pursued a suit against XenForo, or if XenForo admitted to it, and it being an un/authorized breach, and under what circumstances.

 

[Blatchy]

Policies like these are meant to say they will not just casually hand over information to random third parties or bad actors.

You cant have it both ways.

 

[Blatchy]

Discovery alone, in this case, with what's provided at least, won't tell us whether they mishandled it or not.

Certainly it does. They gave an unauthorized party customer information. Says it right there... black and white.

or if XenForo admitted to it,

And if they deny it then its a data breach. Again.. you cant have it both ways.

 

[frm]

You cant have it both ways.

Who's the third party or bad actor? Nardello? Because it seems like Nardello would be the only one powerful enough to compel someone to give the information out, not some willy-nilly @gmail request to an inbox.

Nardello & Co LLP is a high-end corporate investigations/intelligence firm

Certainly it does. They gave an unauthorized party customer information. Says it right there... black and white.

A person "who appears to have been working for" XenForo may have. It's better to separate the person from the entity because the authorization lies with XenForo.

Nothing is as black and white as you make it sound.

It'd be interesting to see Nardello's request and the response they got, because:

Discovery alone, in this case, with what's provided at least, won't tell us whether they mishandled it or not.

But we probably won't get that from XenForo, or unless:

Tattle Life pursued a suit against XenForo, or if XenForo admitted to it, and it being an un/authorized breach, and under what circumstances.

 

[Blatchy]

Who's the third party or bad actor?

Did you read it AT ALL???? It said the plaintiff..

"the first plaintiff emailed his source stating, incorrectly, that his legal team had made an application to court"

 

[frm]

This changes a lot, even though the timeline of events looks bad:

The confidential source within Xenforo advised Neil Sands to continue with an application for a Norwich Pharmacal order. This application for an NPO was sworn on 20 June 2023 and Xenforo responded on 28 June 2023 with the same details that the confidential source had already sent on 14 April 2023.

Source: https://en.wikipedia.org/wiki/Tattl...tial source had already sent on 14 April 2023.

It made the person at XenForo the

judge

and then gave them advice on how to proceed. XenForo then authorized providing the information, again, with the NPO.

 

[smallwheels]

Source: https://en.wikipedia.org/wiki/Tattl...tial source had already sent on 14 April 2023.

That wikipedia entry makes an interesting read as it is easier (and faster) to digest than the court protocol and gives additional info.

It made the person at XenForo the
and then gave them advice on how to proceed. XenForo then authorized providing the information, again, with the NPO.

As you say we should differentiate between the unknown person who was the "source" and XF as a company / legal entity. It is currently the state of things that, what was sent before the NPO was sent by a person while the NPO was answered by the company. Would be interesting to know how this person was approached or informed about the questions / the issue in beforehand, so how they got first in touch with Mr. Sands.

In In general I had found it ok if XF would have answered to the request that there is some data (and possibly even what kind of data) but it can only be released through a court / NPO. So to confirm that it could be worth filing an NPO. And only to release the actual information after the NPO rather than before. Which XF as a company did not but the person did anonymously.

We don't know what the actual content was that the Sands considered to be defamation. It may well be that it was way over the top and clear as water that it was not ok and the person wanted to support the Sands in a pragmatic way (legally or not) or something else that motivated that person, who ever it was. In any case it seems plausible that whatever information was released in beforehand could and would only be used in conjunction with a court case, so would not cause immediate damage to an innocent person directly but depend whatever would happen from the ruling of a court (and an NPO to gain the information officially).

As there was a ruling of GBP 300.000 against Mr Bond what he did seems obviously not to have been ok, according to the court. And as he try to hide behind LTDs, gaining a huge income from what obviously was considered massive defamation by the court he obviously knew that what he was doing was shady. He was neither a white knight nor was it a case of suppressing political opinions or free speech.

If you imagine for a moment you would have personally been in the role of the Sands - would you still consider the source's behavior a no-go? I am not so sure and therefore, based on current knowledge, I still find it kind of tolerable IN THIS SPECIAL CASE and clearly will furthermore give XF the question of doubt that they knew about the NPO but not about the "source" and her doing instead of throwing stones w/o knowing anything about what happened in detail. I do not even need to know what happened in detail as I have the trust that XF will take learnings from the case and I don't even need to know that learnings. But I can understand that others may have a different view.

Sadly, given the audience of this forum and the experience with discussions in the past I do have my doubts if a solid, constructive discussion of value and based of facts, w/o defamation, insults and making up things, is possible on this forums. Which nonthelast the way the topic was placed here by the OP and his later follow-up postings show already proof for.

 

[Blatchy]

Would be interesting to know how this person was approached or informed about the questions / the issue in beforehand, so how they got first in touch with Mr. Sands.

Thats the problem.. You would rather read the cliff notes and ponder a question that was already answered in the judgement.

 

[Tamer]

The court mentions an alleged confidential source. That’s the issue. Everything beyond that, the backdoor, staff access to customer admin panels, a company-wide privacy scandal, has been invented in this thread. The judgment doesn’t say those things. Stop turning one cautious line in a court judgment into a conspiracy theory, and at least be honest about it.

 

[frm]

Thats the problem.. You would rather read the cliff notes and ponder a question that was already answered in the judgement.

Where was it answered in the judgment? It was a very limited view of Discovery, excluding exact correspondence. So, the only thing we have to work with is that, and the anonymous XenForo source told Sands to pursue an NPO (whether in the same conversation or later).

You could say it went something like this:
Sands: We’re being harassed and defamed. We already think it’s Bond. Can you at least tell us if we’re looking in the right direction? (Example nasty threads...)
Anon @ XenForo (April 2023): Off the record? Yeah, probably Bond. Bought licenses on X/Y/Z dates, same postcode, same emails, same payment trail (that could have been shared by Sands to just confirm the suspicion)
Sands: That enough for court?
Anon: Nope. If you want this to survive scrutiny, get a Norwich Pharmacal Order.
Sands to the Nardello (April 2023): “WE GOT ‘EM BOYS!” (Locking in the "off the record" comment, that should've been a phone call, and this probably would've been a non-issue)
June 28, 2023, XenForo officially: "Pursuant to the court order, here are the records."

We will never know because Discovery chose selective pieces of content and not the full correspondence of any party involved.

XenForo covered itself with the NPO.

I just have to be more neutral now, as it's only a theory. Did the person at XenForo anticipate an NPO any day (like tomorrow, from when Sands got the information, and what exactly was that information, i.e., was it new information or comparing information, as they already had quite a bit with Nardello already, and not 2 months later, after internally discussing the matter?

Did the XenForo "staff member" review material and find themselves morally obligated to skip some steps along the way, confirming/adding information, knowing that the NPO would go through, just to help Sands' case move along more quickly? Or did XenForo catch it later, and that became a later conversation to protect themselves, to align exactly with the privacy policy, by ensuring an NPO was submitted?

Without all the sources and documents that was cherry-picked for Discovery, there are now only uncomfortable questions to ask. A person "who appears to have been working for" XenForo is all we have; we don't have the circumstances in which that conversation went down, i.e., "Confirmed. Please submit NPO immediately." (Which, if so, was obviously ignored)

Would the best course of action merely be, "Send in an NPO and we'll get you the information as soon as possible"? More than likely, then there'd be no fuss.

Or, perhaps, did XenForo terminate Bonds' license? That could weaken expectations of confidentiality in some respects.

Too little is said to know what exactly went on.

One thing for a fact that we can all agree upon, though, is that there was no data breach, and there's no backdoor for anyone to just go in and do what they want (without facing internal policy repercussions, though, I believe that issue was settled with the ultimate NPO being granted).

After a short review of Tattle Tell (the actual forum that's still up), I would still lean in favor of XenForo doing the moral thing, which they knew they could get away with later by getting an NPO in hand, fulfilling their privacy policy agreement, through the instructed NPO.

 

[frm]

After legal review, a simple update to the privacy policy that shuts this thread down, and 99.99% of users would likely agree to:

"XenForo Limited will not sell, distribute or lease your personal information to third parties unless we have your explicit permission, are required or permitted by law to do so, or reasonably believe such disclosure is necessary to protect the rights, property, safety or security of XenForo Limited, our users, or third parties."

Reminder: XF is based in UK (same as Tattle Tell) where there are hate speech laws.
Common UK offenses include:

• stirring up racial hatred,
• stirring up religious hatred,
• stirring up hatred based on sexual orientation,
• malicious communications,
• grossly offensive online communications,
• threatening communications,
• and harassment offenses.

...and if you review Tattle Tell, you can see in many threads where those points are hit.

Anybody that disagrees and thinks it applies to them, refer them to Tattle Tell or the fruit site as examples of what's not tolerated.

I believe privacy is a privilege when you decide to push boundaries like this, not a right.

 

[Jake B.]

This changes a lot, even though the timeline of events looks bad:


Source: https://en.wikipedia.org/wiki/Tattle_Life#:~:text=The confidential source within Xenforo advised Neil Sands to continue with an application for a Norwich Pharmacal order. This application for an NPO was sworn on 20 June 2023 and Xenforo responded on 28 June 2023 with the same details that the confidential source had already sent on 14 April 2023.

It made the person at XenForo the

and then gave them advice on how to proceed. XenForo then authorized providing the information, again, with the NPO.

It doesn’t change anything, and says the exact same thing as the original document. The ENTIRE issue is this part:

with the same details that the confidential source had already sent on 14 April 2023.

I genuinely cannot tell if you’re just not reading things you’re copying and pasting as a “gotcha” or if you think they say something different

 

[smallwheels]

...and if you review Tattle Tell, you can see in many threads where those points are hit.

Absolutely. Something what is probably worth mentioning is that the current story came up b/c the court had to decide wether the Sands plaid fair during the trial against Bond that ended with the GBP300.000 and came to conclusion they did not. So this was basically kind of an appellation instance after the first trial. Bond claimed he had not been informed about the process at all and only found out in Dec 2024, more than one year after the ruling. No one can tell if this is true. The Sands had not given the court all information about Mr Sands (like all mail addresses or private address) as they would have been obliged to and send the information about the trial to a hotmail address via an expiring file sharing linke that was never clicked before it expired (and could not have been opened successfully anyway, as it this would have needed a PIN code that was not delivered to Bond). And a couple of things on top of that. The sands solicitor took the blame, claiming it would have been an honest mistake not to give the information they had to the court in full and not deliberately to gain strategic advantage as, with the defended seemingly not knowing about the trial, he seems not have been able to defend himself in court but was still declared guilty. He, on the other hand, hid the best as he could, so did not play to the rules either.

So the whole thing looks a bit like pigs wrestling in the mud and neither side looks exactly sympathetic.

From the court's press release about the recent court ruling (that seems pretty well written and does not mention XF at all):

Was there an abuse of process?

The court noted that it is common practice in cases involving the protection of reputation and online publication for proceedings to issue against persons unknown and to use NPOs1 to garner information in relation to the identify of publishers. A litigant does not need the court’s permission to issue proceedings against persons unknown, although it may require the intervention of the court to ensure effective service and the court will closely supervise the litigation. The solicitor for the plaintiffs now accepts that he ought to have provided information about the identification of Mr Bond to the court at the time of the ex parte hearings in 2023. The court also took into account that had the operators of Tattle Life complied with their legal obligations in relation to transparency around the ownership and operation of the website, there would have been no need to issue proceedings against persons unknown or to seek an SSO.

The court was not satisfied, in all the circumstances, that the plaintiffs had used the court process for a purpose or in a way which was significantly different from the ordinary and proper use of the court process. It therefore declined to strike the action out as an abuse of process.

The BBC reported on the first trial back in June 2025:

The defendant companies and suspected operator of the site, Sebastian Bond, can now be revealed after reporting restrictions were lifted at Belfast's High Court on Friday. The couple obtained £150,000 in damages each as well as legal costs in December 2023 after suing over what they regarded as "hate speech".
(...)The judge said the site had been set up to deliberately inflict hurt and harm on others by allowing the anonymous trashing of people's reputations. (...)

and that the Sands

claimed they were subject to a campaign of harassment, invasion of privacy, defamation and breach of data rights.
The legal battle lasted two years and was undertaken at the cost of Mr and Mrs Sands.

So possibly those claiming privacy rights and data protection may become aware that Mr. Bond had done exactly that. Also neither in the first nor in the latest ruling was there any doubt that he was the person responsible and running the forum and the LTDs that he created to hide his ownership.

Meanwhile the Freedom of Speech Union made a bit of a strange move after the latest ruling and tried to picture Bond as the victim and more or less an innocent child:

Last summer, Sebastian Bond was branded the "King of the Trolls" and publicly vilified after being unmasked as the operator of Tattle Life, an anonymous online forum with 42,000 registered users. A Northern Ireland court awarded the couple who had sued him, Neil and Donna Sands, £300,000 in damages and imposed a worldwide freeze on his assets to a value of £1.8 million. Bond had no opportunity to contest any of it: he first discovered the existence of a case against him when his Nationwide account was frozen in December 2024. (...) "This was like a SLAPP on steroids," says the FSU's Director Lord Young of Acton. "A wealthy couple were able to shut down unwanted speech about themselves by securing a court judgment without even the most basic legal process. Anyone who worries about the powerful or wealthy using high-powered lawyers to shut down free speech should be terrified by this case." The FSU has supported Bond throughout, and this briefing is an attempt to correct a record that has remained badly distorted in public debate.

This does not make them look exactly good in my eyes as they seem to have stretched the story of what has happened in one direction to the most massive extent possible. The "42.000 users" seem hard to believe, given that Tattle life currently has 374.000 registered users...

... and it would be hard to believe that one would gain an income from advertising of GBP 500.000/year (or even the lower GBP20.000/month that Bond himself claimed in 2025, so years later, he would still earn through the ads on the forum) from a forum of 42.000 users. Also, this income makes the story of "wealthy couple" vs. poor forum guy somewhat weak.

For the case and the damage registered users don't matter anyway - rather visitor numbers are more important.