Serious concern: Why were XenForo customers never informed about this alleged internal data leak?

[James Potter]

??????????

 

[smallwheels]

That is a lie by a misinformed person who somehow also missed 20 reiterations of the same thing?

Ok, enough is enough. Either you are a troll or simply unable to follow this thread and understand its content. Either way any further discussion with you is fruitless.

 

[smallwheels]

??????????

“Multiple exclamation marks are a sure sign of a diseased mind.” - Terry Pratchett.

Also true for multiple question marks, I guess. Pratchett's diagnosis was btw. on basis of five exclamation marks, so we do have an even more serious case here.

 

[CedricV]

You people have nothing better to do?

 

[James Potter]

Ok, enough is enough. Either you are a troll or simply unable to follow this thread and understand its content. Either way any further discussion with you is fruitless.

Can you address ¶18? I run one of the largest installations of XenForo in the world. I am simply asking why an employee of XenForo appears to be openly conspiring against their own customers. For the benefit of search engines, here is relevant text where the North Irish courts explain that XenForo has been openly communicating for years to litigious individuals about what sensitive information they hold on their own customers.

---

[18] Discovery has revealed emails passing between the first plaintiff and aconfidential source who appears to have been working for Xenforo, a forum softwareprovider used by Tattle Life until December 2021. The first of these was dated 22March 2023 but it was clearly preceded by previous email correspondence which hasnot been located as it is believed to have involved a different email address. Theemails indicate the source has identified an IP address said to be hosting the TattleLife site. The first plaintiff asked if he should proceed with a court order againstXenforo and is advised that he should.

[19] On 14 April 2023, the first plaintiff sent an email to Nardello in the followingterms:“We have an email and an IP address for tattle ownersFYI.”

[20] Accompanying this email were a series of Xenforo purchase orders, dated between 2018 and 2021, which reveal the name Sebastian Bond, the post code BH** and two email addresses, 5***@gmail.com [email redacted even though it's in a document].

[21] On 24 April 2023, the first plaintiff emailed his source stating, incorrectly, thathis legal team had made an application to court for a production order. Later thatsame evening the source sent a message as follows:“So we have a name which is Sebastian Bond. This webelieve should match the card which was used to pay forthe tattle license including a Poole post code which shouldmatch the card billing address.”

[22] Shortly thereafter in a further email it was said:“The existing site is apparently associated with Lime Gossbut no such entity exists as far as we can tell. But SebastianBond comes up as a director for Yuzu Zest. Maybe atenuous link but worth looking into.”

[23] By 26 April 2023, the first plaintiff is able to tell his source that progress hadbeen made on Sebastian Bond to the extent that “It feels like we are almost there.”

[24] On 1 May 2023, the first plaintiff indicated that the NPO application wasdrafted and that they had been working on addresses for Bond. On 4 May 2023, at 70621 hours, the source emailed stating that Bond had paid Xenforo using a StarlingBank debit card, which was linked to a particular address in Poole, Dorset.

---

And since you threw the first stone of being uncouth, I'd love to know why you're in here holding the line for this company as a customer. Why are you such a bootlicker? Do you get paid? Do you just enjoy licking boots? Is that an English thing?

 

[JamesBrown]

I do consider it valuable (if not essential) to be able to ask critical questions, to give critical feedback or to criticize to product on the customer forums - they should not be reduced to a cheerleading community. I

Whoopy do. I'd rather have those long diatribes outside the peer to peer support forum myself. But we're all different. So you can whoopy do me back.

 

[smallwheels]

I'd rather have those long diatribes outside the peer to peer support forum myself.

We're sitting in the same boat here. Thus the idea for using a different, new section of the forums, that is not public.

And I would really love to see people that insult others like i.e.

Why are you such a bootlicker? Do you get paid? Do you just enjoy licking boots? Is that an English thing?

to be locked out of these discussions as it is obvious, that they are unwilling or unable to a constructive and respectful discussion. Should be normal in any forum that cares for it's culture.

 

[James Potter]

that is not public.

lol

 

[James Potter]

to be locked out of these discussions as it is obvious, that they are unwilling or unable to a constructive and respectful discussion. Should be normal in any forum that cares for it's culture.

You edited this in after I replied, but: I'm sure you'd like critical voices of this to be removed, because for some reason you take this hardline defensive stance despite your information being at risk here. One can only imagine why.

¶24 almost certainly violates the UK GDPR. The order outlines problems created by the plaintiff in this case and that they have weakened their underlying cause in the immediate action. Once victorious, Tattle should pursue relief against XenForo for those violations. Customer privacy is not optional.

If you've never been sued, consider yourself lucky. You're placed at the whims of a big machine you have very limited control over and which costs money just to participate in. Years of your life get sectioned into blocks of time in which you were dealing with it. It's very, very cruel to leak information to a litigant prick.

 

[zappaDPJ]

Do you actually know this? By who's authority? Is this an English thing where all court orders are automatically sealed? How do you know the court order is even real? I am genuinely curious what series of logical steps led up to the point where you believe that the court order is real but cannot be acknowledged officially.

Xenforo was served with a Norwich Pharmacal Order (NPO). NPOs are generally used to obtain information from a third party where the plaintiff does not know the identity of the defendant.

Because the third party is considered innocent of any wrong doing courts often use anonymity orders to prevent publication. In this particular case the document is not listed and therefore unavailable.

We know the court order is real because the outcome is listed and readily available.

However seeing this has become a major topic of discussion I'm surprised nobody has even mentioned that the judgement was recently set aside.

https://www.bbc.co.uk/news/articles/cn0pyr6448do

 

[smallwheels]

However seeing this has become a major topic of discussion I'm surprised nobody has even mentioned that the judgement was recently set aside.

https://www.bbc.co.uk/news/articles/cn0pyr6448do

Don't know if "set aside" is the right wording but yes, it has been mentioned already on page three of this thread:

Something what is probably worth mentioning is that the current story came up b/c the court had to decide wether the Sands plaid fair during the trial against Bond that ended with the GBP300.000 and came to conclusion they did not. So this was basically kind of an appellation instance after the first trial. Bond claimed he had not been informed about the process at all and only found out in Dec 2024, more than one year after the ruling. No one can tell if this is true. The Sands had not given the court all information about Mr Sands (like all mail addresses or private address) as they would have been obliged to and send the information about the trial to a hotmail address via an expiring file sharing linke that was never clicked before it expired (and could not have been opened successfully anyway, as it this would have needed a PIN code that was not delivered to Bond). And a couple of things on top of that. The sands solicitor took the blame, claiming it would have been an honest mistake not to give the information they had to the court in full and not deliberately to gain strategic advantage as, with the defended seemingly not knowing about the trial, he seems not have been able to defend himself in court but was still declared guilty. He, on the other hand, hid the best as he could, so did not play to the rules either.

So the whole thing looks a bit like pigs wrestling in the mud and neither side looks exactly sympathetic.

From the court's press release about the recent court ruling (that seems pretty well written and does not mention XF at all):

The whole thread is based on it b/c the court document that we are using as the foundation of this thread is from this latest trial (and was thus just recently published), so the fact that you mention is written inside this court protocol, so anyone who has read it (which should be expected from anyone who wants to discuss about the thread topic) should be aware of it anyway.

But, to be fair, for the topic most seem to be interested in (the "source" and it's possible/assumed relation to XenForo) it is not too relevant in the end.

 

[Suzanne O]

Are you an actual lawyer by trade @James Potter ?
Just curious here...
All because of all the questioning making you sound like one...

 

[MySiteGuy]

I do consider it valuable (if not essential) to be able to ask critical questions, to give critical feedback or to criticize to product on the customer forums - they should not be reduced to a cheerleading community. It is of value for XenForo as well as for the community and I value that XF makes this possible.

True, it should not be reduced to cheerleading.

On the other side of the coin, there are certain users who seem to find fulfillment in pouncing on every opportunity to criticize. They probably send the local meterologist a complaint whenever the forecast is wrong.

 

[smallwheels]

On the other side of the coin, there are certain users who seem to find fulfillment in pouncing on every opportunity to criticize. They probably send the local meterologist a complaint whenever the forecast is wrong.

I would assume for some to complain about the meteorologist the forecast hasn't to be wrong. It is sufficient if they don't like it or don't like the weather that has been correctly forecasted.

 

[James Potter]

Xenforo was served with a Norwich Pharmacal Order (NPO). NPOs are generally used to obtain information from a third party where the plaintiff does not know the identity of the defendant.

NPO happened months after XF employees fed information to litigants (2023). Read ¶18-24, it's in plain language.

• Before 22 March 2023 — First plaintiff already in email contact with a confidential source "who appears to have been working for Xenforo" (earlier correspondence lost).
• 22 March 2023 — Earliest surviving email from the source; provides an IP address and advises pursuing a court order against XenForo.
• 14 April 2023 — First plaintiff tells Nardello: "We have an email and an IP address for tattle owners." Attaches XenForo purchase orders naming Sebastian Bond, a Poole postcode, and two email addresses.
• 23 June 2023 — First ex parte application. Friedman J grants: anonymity for plaintiffs (EWC/EWD), Reporting Restriction Order, Substituted Service Order (email to Hotmail address only), and Norwich Pharmacal Order against XenForo. The court is told nothing about the source, Nardello's findings, Bond, the Poole address, or the surveillance.
• 28 June 2023 — XenForo complies with the NPO, providing documents including additional email addresses for Bond.

It's entirely possible that they'd have gone for a suit against "persons unknown" to discover who the owners are, but the fact is: XenForo told them they were in an area the Crown could reach and so litigating wouldn't be fruitless. Literally, told them to go after them in court because they could do it. The NPO seems like it was almost a direct consequence of this action and I can only speculate if this legal action would have progressed without XenForo's active participation and preemptive delivery of identifying information.

As far as anyone knew before XenForo voluntarily assisted them in litigation, they [the owner] could have been American and insulated from the underlying causes of action (harassment, misuse of private information, breach of data rights [the UK GDPR ironically], and defamation). There was no reason for XenForo to do this except that they must have taken a principled stance that such a website did not deserve to exist unmolested and they took voluntary actions to ensure it, and its owners, would be encumbered in its existence.

P.S. Part of the reason why this is so dangerous is that, without the court order, they have no idea if this was actually a legitimate legal issue or not. They handed over information which could have been to a dangerous person intending an extrajudicial, violent, physical attack on the owner. Something as simple as an email can, and frequently does, lead to an address. Instead of being sued, the owner of Tattle could have ended up stabbed on his doorstep. The only thing XenForo knew for sure is that the person they were corresponding with was hostile to their customer.

 

[JamesBrown]

If you've never been sued, consider yourself lucky. You're placed at the whims of a big machine you have very limited control over and which costs money just to participate in. Years of your life get sectioned into blocks of time in which you were dealing with it. It's very, very cruel to leak information to a litigant prick.

Really upset with xF? Then vote with your feet mate. Don't matter how big your installation, it costs the same as anyone elses here. .

Simple machines are on 2.7 now, your 'largest' installation will love it.

 

[D.O.A.]

I think your thread headline is misleading.


Welcome to the real world. If you don't want to take responsibility for your actions in court better don't use your credit card and mail address to buy stuff for your - in this case obviously filthy - business that later gets sued successfully and obviously for a reason. Or simply avoid running a filthy business.

Maybe the context of what has happened is of interest and matters:

• a person ran a forum named "tattle life" for what reads as gossip about influencers and more or less prominent people
• according to the court: "Tattle Life describes itself as "a commentary website on public business social media accounts". It permits members of the public to comment and criticise individuals who "choose to monetise their personal life as a business", including so‑called influencers." One may imagine what that may mean in reality - possibly a plattform full of defamation and hate speech.
• this forum war run on XenForo (at least in earlier years) and run anonymously by someone who first hid behind a British Ltd. and then behind one in Hongkong.
• a female inlucencer and her husband felt they were badly insulted and defamated on this forum and tried to get hold of the owner to sue him
• they filed for 300.000GBP in 2023
• they won, so obviously, they had a case
• the defendant made huge sums from the forum, according to the court:
On the evidence before the court, the website receives millions of visits per month and generates an income through online advertising. At its peak, Tattle Life had an annual income of over £500,000.

Additional financial details:

Spoiler

Yuzu Zest Limited had a net asset balance of £601,000, all in cash, on 31 March 2023. Since its incorporation in 2019, the company had steadily accumulated cash reserves through advertising revenue for Tattle Life."
The company paid a large dividend of £140,000 to Mr Bond in December 2023, shortly after judgment had been entered in these proceedings against persons unknown.
Between April and August 2024, Yuzu Zest Limited made a number of transfers, totalling some US $90,000, to Kumquat Tree Limited, the third defendant. It had been incorporated in Hong Kong in February 2024.
On 2 September 2024 the company transferred £898,632 to Mr Bond and the following day two dividend payments, totalling £12,950, were also paid to him.
A resolution to wind the company up was passed on 27 September 2024 and Mr Bond swore a declaration of solvency which stated the expected surplus for distribution to be £903,000. At this time, the monies which had been transferred to Mr Bond were treated as being a director's loan.
On 10 July 2025 the liquidators prepared a statement of affairs which identified unsecured claims against the company (including the costs and damages in this action) of £1,392,053 with assets of just £7,567.95. On 30 July 2025 the members' voluntary liquidation was converted to a creditors' voluntary liquidation.

Mr Bond also gave an interview to Unherd magazine in September 2025 in which he admits using the name "Helen McDougal" as a pseudonym and stating that the website continues to generate income of some £20,000 per month, paid to a company in Hong Kong.

So we are clearly not talking about a small non-commercial hobby forum here or about SLAP or anything like that. Today, the website looks like this:

View attachment 338311

View attachment 338310


Xenforo has received a court order to lay open documents regarding the website like who bought the license for XenForo and other data that they may have regarding the case. They followed that order and this helped to give more evidence (there was evidence before) that the defendant ran the forum and was involved.

The issue is that an - according to the court - "source" from probably inside XenForo ( a confidential source who appears to have been working for Xenforo ) had given parts of this information to the plaintiffs or their lawyers before the court order had been made, earlier in the process. Nobody (publicly) knows who that was, nobody knows what the background for that may have been, all according to the document linked on Admin Zone.

Therefore it may be fair to ask what has happened and what the background was - but unfair to do this in the way you do it. And also, you'd have to live with an answer "this is none of your business", which would be totally ok in my eyes - but I'm sure you won't accept it.


Yes, you do.

No. Why? It was a single case, three years ago, the data given would have been requested by the court later anyway. No other person affected. Data was not publicly released (but now has been by the court) but given to the plaintiffs (or their lawyer or investigator) in conjunction with a court case that seems to have been more than valid. This does not qualify as a "data leak" in the sense of GDPR. In case of a data breach those who are affected have legally to be informed. Well, he has been...

What a useless wall of utter crap you typed. Xenforo broke their own terms by ratting out the user before any court order was issued. This could turn into a lawsuit against xenforo easily, and probably should, they've given user details to a third party without consent or a legal demand, just because feelings. Your reply is a disgusting ignorance of the facts. Just when I thought the English couldn't bend over any harder, here we are. Absolute ****ty behaviour by the company.

Lowendbox Article: https://archive.is/rxDCL

 

[Slavik]

Something as simple as an email can, and frequently does, lead to an address.

Which as I said, something as simple as a compromised email, could have all the information provided and more.

We know from the court documents that Bond never opened the SSO, it seems likely that if someone had gotten access to his email account, this may have been why. After all, admitting you obtained information via illegal means opens you up to the criminal repercussions of doing so, pretending to be a leaker from an (assumed) anonymous email deflects that away.

At this point the rest of your posts are just hyperbole and speculation (as is most of this thread tbh).

 

[Suzanne O]

What a wall of crap you typed. Xenforo broke their own terms by ratting out the user before any court order was issued. This could turn into a lawsuit against xenforo easily, they've given details to a third party without consent or legal grounds.

FYI Xenforo can kick anyone out if their licence breaks their Terms and conditions.
They're the ones that check our licencing information and our forums.
That's why it's best to keep your forum in the positive frame of mind.
Ok sure you want to be negative about Xenforo and you have a public forum look out these guys can get you.

 

[D.O.A.]

Which as I said, something as simple as a compromised email, could have all the information provided and more.

We know from the court documents that Bond never opened the SSO, it seems likely that if someone had gotten access to his email account, this may have been why. After all, admitting you obtained information via illegal means opens you up to the criminal repercussions of doing so, pretending to be a leaker from an (assumed) anonymous email deflects that away.

At this point the rest of your posts are just hyperbole and speculation (as is most of this thread tbh).

Do you legally represent the company position in this matter or are you just typing excuses for their behaviour?