AVAST Software, the Czech Republic-based antivirus company, has shut down its community-support forum after suffering a data breach that affected roughly 400,000 users.
According to Vince Steckler, CEO of AVAST Software, the forum was hacked over the past weekend and attackers gained access to names, usernames, email addresses and password hashes.
The company highlights the fact that only forum users are affected, which represents around 0.2% of the company’s customer base of 200 million users. There’s no evidence that payment, license or financial data has been compromised, Steckler noted in a blog post May 26.
The company believes the cybercriminals can crack the passwords so customers are being advised to change their passwords. Once the forum is brought back online, AVAST will reset all passwords, but customers who have utilized the same passwords for other online services are urged to change them as soon as possible.
The attack targeted the third-party software platform hosting the forum, which AVAST told SecurityWeek was running Simple Machines Forum (SMF) version 2.0.6.
“The latest version is SMF 2.0.7 but according to the SMF change log (and the announcements on the SMF web site) there were no security-related updates included in this version. It is not clear whether the attack was conducted via a 0-day vulnerability or a hole that was silently fixed in v2.0.7 but never announced,” AVAST representatives said in an emailed statement.
The antivirus firm says it will keep the forum offline until it rebuilds it and moves it to a different platform.
In its announcement to users, the company didn’t disclose the type of hashing algorithm used to secure passwords. However, AVAST told SecurityWeek that they haven’t made any modifications to the SMF software, which uses SHA1 with salt.
This isn’t the first time hackers have hit AVAST. In October 2013, it was one of the many high-profile companies whose websites were hijacked by pro-Palestinian hackers of KDMS Team through DNS poisoning. At the time, the attackers didn’t actually penetrate AVAST’S systems. Instead, they changed the company’s DNS records after breaching Network Solutions.
