Actor Claims to Offer bf.st Codebase and Database for Sale After Alleged Compromise
Summary
A forum actor claims to sell bf.st’s codebase and database, allegedly obtained through a launch-period vulnerability. The post shows 128 database tables and sample user records; the claim is unverified.
Key points
- The actor, mrwho, claims to offer the bf.st codebase and database for sale.
- The alleged compromise reportedly occurred in late May or early June 2026, exploiting a vulnerability in the forum implementation.
- The sale post displays a 128-table database listing and sample user rows.
- Reportedly exposed fields include usernames, email addresses, password values, salts, login keys, and 2FA data.
- The claim is unverified; the seller reportedly requires payment in XMR.
Article Details
- Victim Organization
- bf.st forum
- Victim Domain
- bf.st
- Incident Type
- Alleged compromise of a forum through a vulnerability in its implementation, with the codebase and database offered for sale
- Data Types Exposed
- Usernames
- Email addresses
- Password values
- Salts
- Login keys
- Two-factor authentication data
- Affected Records
- The sale post reportedly includes sample user records; total affected records are not disclosed.
- Affected Data Size
- The post shows a database listing with 128 tables; total data size is not disclosed.
- Operational Impact
- Unknown; the reported compromise and any disruption are unverified.
- Ransom Or Extortion
- A forum actor named mrwho claims to offer the codebase and database for sale, reportedly for XMR-only payment.
- Claim Status
- claimed