All,
Earlier this week Bully-Board was compromised using an inactive administrator's account. Unfortunately, logs indicate the threat actor used Simple Machine Forum's backup utility to ex-filtrate a backup of the database. This backup would have contained hashed passwords, Email addresses, posts, private messages, IP addresses, and anything else you may have shared with the forum. If you re-used your password anywhere, I'd highly advise you to change them immediately.
After discovering the compromise, I took the forum offline for a few days to dig through files and the database to check for any further indications of compromise. While things looked clean, in abundance of caution I've spent a few hours rebuilding the site from the latest clean version of Simple Machines Forum. Past administrators who have not logged in for a few years have had their permissions revoked.
I've also scrambled password hashes - meaning you will need to use the password reset if this is your first time visiting since the compromise. I apologize for the inconvenience this caused.
Thanks,
AJ
