Well it does narrow it down then who passed on sensitive customer information without a court order.
Serious concern: Why were XenForo customers never informed about this alleged internal data leak?
- Status
So what is it with that part about passing on sensitive customer information without a court order?
Just curious! Because that's what I understood as a backdoor to customer information.
I assume that’d be from XF records, not from logging into random customer XF installs. Your xenforo install admin panel won’t have any sort of customer information in it unless you’ve specifically added it yourself anyways
An employee of a company violating privacy laws should concern you
Are these things true? Were the leaks related to this specific case only, or is it possible they were more broad? Could this explain how this member got some of our email addresses, and why XF never even replied to that thread?
The company is hearing about what for the first time? According to court documents, "Xenforo formally complied with the NPO on 28 June 2023, the day after it was served.".
The first time about a "leak".
Well someone is not being truthful here.
Xenforo hails itself as having a fairly small staff, so unless every single person has access to sensitive customer information (which still would remain a small number), that narrows the scope quite a bit.
With such a small staff I struggle to believe that this was some big revelation today.
I'm the cybersecurity guy for a few financial organizations and online schools.
Xenforo co. allowing someone to look at their client database and giving information on a single client to plaintiffs does not constitute a data breach; well call something a data breach when the data is accessed by an unauthorized person, typically a hostile hacker. And also a data breach implies multiple records ( usually the whole database ) are accessed.
It is not abnormal for any company working with law enforcement to hand over bits of information - they're going to be legally required to do so. This is not considered a data breach either.
Squarewheels doesn't understand what he is talking about and looks like an AI typed most of his response.
The original post is melodramatic and deeply incorrect and not worth forwarding on, it causes alarm when none is needed and you are amplifying that.
Xenforo co. allowing someone to look at their client database and giving information on a single client to plaintiffs does not constitute a data breach; well call something a data breach when the data is accessed by an unauthorized person, typically a hostile hacker. And also a data breach implies multiple records ( usually the whole database ) are accessed.
It is not abnormal for any company working with law enforcement to hand over bits of information - they're going to be legally required to do so. This is not considered a data breach either.
Squarewheels doesn't understand what he is talking about and looks like an AI typed most of his response.
The original post is melodramatic and deeply incorrect and not worth forwarding on, it causes alarm when none is needed and you are amplifying that.
Last edited:
Ignore the AI generated nonsense, read the actual court document linked, that’s what states that a “confidential source” from XenForo provided personal information about the license holder before there was any court order, and later says XenForo complied with the court order. These are two separate things, the latter being completely normal and a legal requirement, the former being a massive back door exchange of customer information, and a huge privacy issue
All of this was before that court order.
Sure, it's a privacy issue, you don't want one of your vendors bending to government or lawyers unnecessarily, but let's not call it a data breach is what i'm getting at.
However, I would be concerned with this if your forum's content is substantially illegal or politically contentious.
What is contentious or illegal is not necessarily what is moral and not moral. Governments can change laws on a dime.
In this regard, if that part of the claim is true, then Xenforo may be able to improve how they handle customer data.
But man let's not call this a data breach. Concerning, but nobody's going to put in shifts at the long week factory cleaning up the damage:
However, I would be concerned with this if your forum's content is substantially illegal or politically contentious.
What is contentious or illegal is not necessarily what is moral and not moral. Governments can change laws on a dime.
In this regard, if that part of the claim is true, then Xenforo may be able to improve how they handle customer data.
But man let's not call this a data breach. Concerning, but nobody's going to put in shifts at the long week factory cleaning up the damage:
Last edited:
"On 23 June 2023 the court also made a Norwich Pharmacal Order ("NPO") against Xenforo Limited requiring this company to deliver up information in its possession which identified or assisted in identifying the operators of Tattle Life and the proper defendants."
Is not "alleged, its was part of discovery
" Discovery has revealed emails passing between the first plaintiff and a confidential source who appears to have been working for Xenforo, a forum software provider used by Tattle Life until December 2021. The first of these was dated 22 March 2023 but it was clearly preceded by previous email correspondence which has not been located as it is believed to have involved a different email address. The emails indicate the source has identified an IP address said to be hosting the Tattle Life site. The first plaintiff asked if he should proceed with a court order against Xenforo and is advised that he should."
Being based in the USA, i had to look that up:
https://en.wikipedia.org/wiki/Norwich_Pharmacal_order
Is the mechanic: if that govt suspects you are indirectly part of something, they can require all kinds of information from you?
https://en.wikipedia.org/wiki/Norwich_Pharmacal_order
Is the mechanic: if that govt suspects you are indirectly part of something, they can require all kinds of information from you?
If this information was given before the court order, as alleged, it's a violation of their own privacy policy.
None of your quotes address actively cooperating with law enforcement during an ongoing investigation. While it is not explicitly stated, the language can reasonably be interpreted to allow cooperation where they believe there is a lawful basis to do so, even if that does not mean a court order in hand. Perhaps they cooperated, and in order to secure the case, they got the NPO later. I'm unsure how law works there.
Policies like these are meant to say they will not just casually hand over information to random third parties or bad actors.
There is explicit language that you might be accustomed to in agreements with, say Google, that nobody reads, but this isn't the blanket protection you made it out to be.
If you're so concerned, though, maybe you should terminate the agreement and hide behind your own forum software and shell companies.
(Or just don't engage in activities that XenForo could reasonably see are illegal)
Just my 2¢.
Policies like these are meant to say they will not just casually hand over information to random third parties or bad actors.
There is explicit language that you might be accustomed to in agreements with, say Google, that nobody reads, but this isn't the blanket protection you made it out to be.
If you're so concerned, though, maybe you should terminate the agreement and hide behind your own forum software and shell companies.
Because, if my interpretation is wrong,
(Or just don't engage in activities that XenForo could reasonably see are illegal)
Just my 2¢.
Did you actually read the filing because you have been blindly throwing darts and moving goalposts.
"On 24 April 2023, the first plaintiff emailed his source stating, incorrectly, that his legal team had made an application to court for a production order. Later that same evening the source sent a message as follows:"
Law enforcement wasnt even involved.
None of my sites are even remotely illegal, immoral, or even questionable in any way. Still, I'm concerned about my own privacy. I don't think it's too much to expect that a company won't share my private information unless they're "required by law to do so" rather than just when they're asked. I'd expect XF to have consulted an attorney before they responded. I'd also have expected them to only respond to a formal request by the courts, which is what the company did.
Also, though, I don't believe there was any kind of gross negligence here. I also don't believe this was a "data breach". If this is true, it would mean there's simply a bad actor within the XF company. If it's true, I hope they're able to figure out who that bad actor is and take the necessary and appropriate actions, as they deem necessary, to ensure it doesn't happen again.
- Status