Serious concern: Why were XenForo customers never informed about this alleged internal data leak?

Status
Not open for further replies.
I was going to stay out of this one but i'll bite.
It's not a nice feeling to have your reputation ruined by some people taking you through the law courts.
Considering that @Starbucks brought this one up and seems to be stinking up his own thread with stuff that could get him into contempt of court type of trouble, i'll be brief.
This is why when i talk about Xenforo i keep it positive because you don't want to be giving a small business a heap of defamatory information.
I also do not wish to insult the staff here even though they have me in the post approval queue. Laugh all you want but even i can see what their next course of action will be.
So be kind
 
Internally
Yes, of course. Unless XF seems it necessary, none of us need to know what happens. I'm just saying, if someone on staff did what is being said, something should be done to prevent it from happening again. Whether we ever know what that is, I couldn't care less.

Did they? Maybe you're from the US? Australia, similar to the UK, you are required by law to follow the directions of police and court officers, by law, no court order needed. That is legal, without court order. If a solicitor asked you for information, or random person, that is not legal and up to yourself, but if a police officer asks for it, or a court officer, that is already standing law, and you can provide it legally to them. You certainly do not need a court order for everything in Australia, and being Commonwealth and all, UK is no doubt similar. Court orders are used here, but they aren't required for everything.
Well this is good to know, and probably something that someone should've made clear at the beginning of this thread, unless they did and I just missed it, because, from my perspective, that's the entire issue here. If the staff member was truly required to reply, then I see no issue.
 
Read the full judgment and the entire thread before posting.The part that concerns me isn't the NPO compliance that was lawful and expected. It's this sequence from the judgment itself:
  • 22 March 2023: source already in contact with the plaintiff, had identified an IP address hosting Tattle Life
  • 14 April 2023: plaintiff forwards Nardello XenForo purchase orders showing Bond's name, postcode, and email addresses
  • 24 April 2023: source confirms the name matches the card used to pay for the Tattle Life license and the Poole billing postcode
  • 4 May 2023: source identifies the specific bank (Starling) and address the card was registered to
That's two months of disclosure before the NPO existed, including payment card billing data and infrastructure information.

I'll wait for an official statement before deciding anything on my end. What surprises me is how quickly some posters in this thread want to shut the question down rather than let XenForo address it. As a paying customer I think the question is legitimate and the silence is what's actually damaging trust, not the asking.
 
Title change ?

Serious concern: Why were XenForo customers never informed about this alleged internal data leak?​


is this a concern: Is it Xenforo's role to let us know when they are dragged into lawsuits about certain quasi legal websites and information is being requested by legal authorities ?​

 
Well from reading back it sounds like there wasn't an internal data leak. There was a court case about a forum and someone from Xenforo gave evidence.
 
I'll wait for an official statement before deciding anything on my end. What surprises me is how quickly some posters in this thread want to shut the question down rather than let XenForo address it.
Who wanted to shut the question down? Please quote.
As a paying customer I think the question is legitimate and the silence is what's actually damaging trust, not the asking.
No one has said the question would not be legitimate. What was questioned was the aggression and the sensationalism from some that went along with it. But given that this happened three years ago, the thread was posted just two days ago and XF said they learned about this "source" thing just now through this thread and even after reading the court documents a lot is unclear: Don't you think they should been given the time to find out what really happened, if really s/o of the XF team was the "source" mentioned and if so, what they decide to do?

It is not that this is something that calls for emergency action due to urgency or harm that would or could immediately happen to XF customers otherwise. Possibly rushing this would not be adequate anyway and it should sorrowly be investigated what happened internally. It is just once more that some people accuse, judge and start to cry "hang them higher" before and w/o even knowing what has happened (and sometimes w/o even bothering to read the documents that are the foundation of the issue). Seems that some are not so much interested in clarity but in sensationalism and in raging out against XF blindly as it happens quite frequently over the last couple of months. And what they demand seems inadequate anyway as it seems some want all the dirty stuff, best live on camera. Basically some behave as if they could well be forum members of that tattle life forum, seems to fit their needs and behavior.
 
Read the full judgment and the entire thread before posting.The part that concerns me isn't the NPO compliance that was lawful and expected. It's this sequence from the judgment itself:
  • 22 March 2023: source already in contact with the plaintiff, had identified an IP address hosting Tattle Life
  • 14 April 2023: plaintiff forwards Nardello XenForo purchase orders showing Bond's name, postcode, and email addresses
  • 24 April 2023: source confirms the name matches the card used to pay for the Tattle Life license and the Poole billing postcode
  • 4 May 2023: source identifies the specific bank (Starling) and address the card was registered to
That's two months of disclosure before the NPO existed, including payment card billing data and infrastructure information.
As was written before in this thread: Apart from the IP address the information could have come from other sources as well. Must not necessarily have been a member of the XF team. Yet it is possible and based on the court protocol it clearly hints in that direction (or at least to someone with access to internal XF data).

Regarding the IP-address: Today, the forum in question is hiding behind Cloudflare and was possibly at the time as well, given the size of the forum and the desire to hide in anonymity of the forum owner. Still, as we know, not impossible for someone outside XF to find out the real server IP, depending from the configuration (in the simplest case through mails sent by the forum). And apart from that an IP address of a server can barely be considered personal data.

However, this is what the court protocol says in regards of XenForo and the "source":

On 23 June 2023 the court also made a Norwich Pharmacal Order ("NPO") against Xenforo Limited requiring this company to deliver up information in its possession which identified or assisted in identifying the operators of Tattle Life and the proper defendants.

In September 2022, the first plaintiff was engaging directly with Nardello & Co LLP ("Nardello"), an internationally renowned investigations firm, seeking to identify a woman referred to as "Helen W" who was at that time believed to be an administrator of the website. On 6 October 2022 Nardello provided its business proposal to the first plaintiff. By 11 October, solicitors in the firm of Gateley Legal had become involved and a formal letter of engagement was sent by Rory Lynch of that firm on 17 October 2022.

Discovery has revealed emails passing between the first plaintiff and a confidential source who appears to have been working for Xenforo, a forum software provider used by Tattle Life until December 2021. The first of these was dated 22 March 2023 but it was clearly preceded by previous email correspondence which has not been located as it is believed to have involved a different email address. The emails indicate the source has identified an IP address said to be hosting the Tattle Life site. The first plaintiff asked if he should proceed with a court order against Xenforo and is advised that he should.


The pre-proceedings communications​

[19] On 14 April 2023, the first plaintiff sent an email to Nardello in the following terms:
"We have an email and an IP address for tattle owners FYI."
[20] Accompanying this email were a series of Xenforo purchase orders, dated between 2018 and 2021, which reveal the name Sebastian Bond, the post code BH** * and two email addresses, 5****@gmail.com and bastian.durward@nestandglow.com.
[21] On 24 April 2023, the first plaintiff emailed his source stating, incorrectly, that his legal team had made an application to court for a production order. Later that same evening the source sent a message as follows:
"So we have a name which is Sebastian Bond. This we believe should match the card which was used to pay for the tattle license including a Poole post code which should match the card billing address."
[22] Shortly thereafter in a further email it was said:
"The existing site is apparently associated with Lime Goss but no such entity exists as far as we can tell. But Sebastian Bond comes up as a director for Yuzu Zest. Maybe a tenuous link but worth looking into."
[23] By 26 April 2023, the first plaintiff is able to tell his source that progress had been made on Sebastian Bond to the extent that "It feels like we are almost there."
[24] On 1 May 2023, the first plaintiff indicated that the NPO application was drafted and that they had been working on addresses for Bond. On 4 May 2023, at 0621 hours, the source emailed stating that Bond had paid Xenforo using a Starling Bank debit card, which was linked to a particular address in Poole, Dorset.

The first ex parte application​

[30] The first application made by the plaintiffs was grounded on an affidavit from their solicitor, Peter Barr, sworn on 20 June 2023. It set out in some detail the alleged tortious acts relied upon by the plaintiffs. It stressed that the plaintiffs would be unable to fully enforce their legal rights until the real identities of the defendants were known, and that any RRO would only be for a short period until this was revealed. The affidavit also deposed as to the need for a NPO against Xenforo who had indicated that it had details which would assist in this identification and that they were willing to provide such information but required a court order. It also stated that the plaintiffs had instructed Nardello and they had indicated that the Xenforo information was likely to be of assistance in identifying the defendants. However, there is no reference whatsoever to the Nardello report dated 6 June 2023 addressed to the plaintiffs' solicitors or the information contained therein about Bond, the address in Poole, the payments to Xenforo or the surveillance operation.
[31] The plaintiffs also swore affidavits addressing the nature of the abuse they had been subject to and its direct effects on their lives. They did not address the source or the efforts to identify the operator of the website, including the identification of Bond by Nardello.
[32] At the hearing on 23 June 2023, Friedman J asked about the nature of the RRO and was told by counsel that this was likely to be of short duration until the relevant information had been received from Xenforo and the relevant persons identified. There was no mention at that hearing of either Sebastian Bond or Yuzu Zest Limited.
[33] On 28 June 2023, Xenforo responded to the NPO, providing the documents sought. These included references to the email addresses above and also to another, c*******@gmail.com. Mr Darby of Xenforo commented:
"I believe there is concrete and actionable information contained within this data production and I wish you and your client well in your pursuit of Sebastian Bond."
[34] On the same date, Mr Lynch communicated this to Nardello and commented:
"We can use that as evidence before the Court to apply to add the culprit as the Defendant to our legal proceedings and also identify his contact details (such as home address) for service and the court record."

The third ex parte application​

[43] Prior to the hearing of the assessment of damages, a fourth report was prepared by Nardello and sent to the plaintiffs' solicitors on 13 October 2023. It repeated the "high degree of certainty" conclusion in relation to Bond's link to tattle.life. It also included an addendum in relation to Yuzu Zest Limited and stated:
"It is plausible that Yuzu Zest Ltd is a company used to receive revenue from the monetisation of tattle.life"
[44] A fifth Nardello report was produced on 31 October 2023, expanding on the information relating to Yuzu Zest and the need for further disclosure orders.
[45] On 6 November 2023, the first plaintiff emailed his source asking whether Xenforo would have the debit card details used to buy the Tattle Life software since he was looking to deliver this to the courts. The answer was that they would only have the last four digits of the card number.
[46] A sixth Nardello report was forthcoming, dated 29 November 2023, which was identical to the one of 31 October save for a reference to Starling Bank as another candidate for a disclosure order.

I am personally honestly not too much interested in the dirty details and who the source may have been. It is up to XF to investigate the matter and take their learnings from it and personally I do not even need to know what those may be.

In this very special case I can accept delivery before the NPO, given the harassment hat had been ongoing and as it has clearly not hit the wrong person. Yet, from a professional perspective, I am wondering why, if the source was inside XF, it did not simply wait for the NPO to arrive before revealing the actual data. Nothing against confirming upfront that such data exists and one would be willing to cooperate. But where is even the advantage to deliver upfront, again in this case?

Even honoring the willingness to help a victim of defamation and hate speech I am also a bit baffled that it seems the source had not only disclosed the name etc. but seems to have mailed actual documents - and also about how this whole source-thing came up to the eyes of the court at all, given that the plaintiffs had hired not only expensive solicitors but also an expensive investigation firm.

As written before the long timeline based article (looooong loading time) about the case


gives a bit flesh to the bone regarding the context of the case. Would probably also be interesting to find and read the first ruling of the court from 2023.
 
Last edited:
In this very special case I can accept delivery before the NPO, given the harassment hat had been ongoing and as it has clearly not hit the wrong person. Yet, from a professional perspective, I am wondering why, if the source was inside XF, it did not simply wait for the NPO to arrive before revealing the actual data. Nothing against confirming upfront that such data exists and one would be willing to cooperate. But where is even the advantage to deliver upfront, again in this case?

Even honoring the willingness to help a victim of defamation and hate speech I am also a bit baffled that it seems the source had not only disclosed the name etc. but seems to have mailed actual documents - and also about how this whole source-thing came up to the eyes of the court at all, given that the plaintiffs had hired not only expensive solicitors but also an expensive investigation firm.
The law doesn't have a "special case" exemption based on how unsympathetic the data subject is. If it did the protections would be meaningless for everyone lol

For me if this is true it's a major thing that would affect future and existing customers. Yes the judgment references events from 2023 but if it's true, what happened during those 3 years? More leaked info? Other customers? That's the part that should concern every paying customer here!

And if the disclosures did come from inside XenForo, this potentially engages multiple UK laws, not just the privacy policy DPA, multiple UK GDPR articles, Computer Misuse Act, common-law breach of confidence etc

Chris replied in this thread and didn't deny it. That concerns me too. Waiting for an official statement and genuinely hoping this turns out not to be true because if it is XenForo could be in real trouble
 
Chris replied in this thread and didn't deny it.
Don't be silly. The thread was brought up Wednesday at 8:22 PM. Chris answered at 11:28 PM on the same day, three hours later, long after work hours.

If an official statement is to be made about anything then it will be made at an appropriate time by an appropriate person. To the best of my knowledge all of us in the company are hearing about this for the first time today.

People may of course wish to discuss it which is reasonable, but we will step in if the conversation is no longer respectful to its participants.
Do you really expect him within 3 hours to digest the court document, to find out who could have had access to the data three years ago, to investigate the case, to successfully contact and ask all possible people in a way that no doubt was left, to create a strategy, to prepare communication and finally to communicate the outcome. All that long after work hours and given the fact that he is not even general manager of the company, so it would neither be his job nor under his authority?

So what he did was responsible behavior: He acknowledged that something is on the table that is new to him (and probably the others in the team) and nothing more. How could he deny it w/o an investigation having taken place before?

Yes the judgment references events from 2023 but if it's true, what happened during those 3 years? More leaked info? Other customers? That's the part that should concern every paying customer here!
Valid questions, but don't you shoot a bit fast, given that you don't know what has happened at all, the event in question ended in a justified, successful and ligitimate court case (which was foreseeable back then already) and you probably don't have the slightest indicator, let alone evidence that this has happened a second time, let alone regularly, let alone outside of a situation like the one in the trial?

XenForo could be in real trouble
Probably not really. If so mainly b/c of some customers rage out and make up things, like they do constantly at the moment. If those would leave it would maybe even be good for XenForo and this forum. To me, until now, this is a storm in a glass of water.
 
Don't be silly. The thread was brought up Wednesday at 8:22 PM. Chris answered at 11:28 PM on the same day, three hours later, long after work hours.


Do you really expect him within 3 hours to digest the court document, to find out who could have had access to the data three years ago, to investigate the case, to successfully contact and ask all possible people in a way that no doubt was left, to create a strategy, to prepare communication and finally to communicate the outcome. All that long after work hours and given the fact that he is not even general manager of the company, so it would neither be his job nor under his authority?

So what he did was responsible behavior: He acknowledged that something is on the table that is new to him (and probably the others in the team) and nothing more. How could he deny it w/o an investigation having taken place before?


Valid questions, but don't you shoot a bit fast, given that you don't know what has happened at all, the event in question ended in a justified, successful and ligitimate court case (which was foreseeable back then already) and you probably don't have the slightest indicator, let alone evidence that this has happened a second time, let alone regularly, let alone outside of a situation like the one in the trial?


Probably not really. If so mainly b/c of some customers rage out and make up things, like they do constantly at the moment. If those would leave it would maybe even be good for XenForo and this forum. To me, until now, this is a storm in a glass of water.
Fair on Chris's timeline. My point was just that no denial has been offered yet, not that one should have been offered within 3 hours

And on customers leaving being "good for XenForo" I'd just say that paying customers raising legitimate concerns about their own data isn't a problem to be solved by them going away.

Leaving it there. Waiting for the official statement like I said.
 
My point was just that no denial has been offered yet, not that one should have been offered within 3 hours
Come on, it's been just two days. Don't you think you react a bit hysterical?
I'd just say that paying customers raising legitimate concerns about their own data isn't a problem to be solved by them going away.
Nobody has said that.
 
I just don't understand why xF allow threads like this. Does them no favours.

I'd shut the off-topic forums down tomorrow and run the place strictly as xF software peer to peer support as is, nothing else. Anything that isn't a question about the software, or getting the best out of it, deleted.

For those who would email twice a day, three times on weekends, asking when the next version drops, why Kier doesn't post anymore, or the classic "I'm not a shareholder but I want answers now" crowd, I'd hand out a dedicated email address. Then point a cheerful little AI bot at the inbox to fire back replies at lightning speed

Everyone's happy. Especially me and the bot.
 
I just don't understand why xF allow threads like this. Does them no favours.

I'd shut the off-topic forums down tomorrow and run the place strictly as xF software peer to peer support as is, nothing else. Anything that isn't a question about the software, or getting the best out of it, deleted.

For those who would email twice a day, three times on weekends, asking when the next version drops, why Kier doesn't post anymore, or the classic "I'm not a shareholder but I want answers now" crowd, I'd hand out a dedicated email address. Then point a cheerful little AI bot at the inbox to fire back replies at lightning speed

Everyone's happy. Especially me and the bot.

Maybe the best idea I've read in these forums in some time. I, personally, would've done this years ago. Actually, I did do it on two of my sites.
 
I just don't understand why xF allow threads like this. Does them no favours.

I'd shut the off-topic forums down tomorrow and run the place strictly as xF software peer to peer support as is, nothing else. Anything that isn't a question about the software, or getting the best out of it, deleted.

For those who would email twice a day, three times on weekends, asking when the next version drops, why Kier doesn't post anymore, or the classic "I'm not a shareholder but I want answers now" crowd, I'd hand out a dedicated email address. Then point a cheerful little AI bot at the inbox to fire back replies at lightning speed

Everyone's happy. Especially me and the bot.
Operator Owner GIF by Home Care Ops
 
I just don't understand why xF allow threads like this. Does them no favours.

I'd shut the off-topic forums down tomorrow and run the place strictly as xF software peer to peer support as is, nothing else. Anything that isn't a question about the software, or getting the best out of it, deleted.

For those who would email twice a day, three times on weekends, asking when the next version drops, why Kier doesn't post anymore, or the classic "I'm not a shareholder but I want answers now" crowd, I'd hand out a dedicated email address. Then point a cheerful little AI bot at the inbox to fire back replies at lightning speed

Everyone's happy. Especially me and the bot.

It's all open and honest discussion. Why limit the speech of others?
 
Status
Not open for further replies.
Back
Top Bottom