Dutch horse forum secure for 25 years, then hackers broke in and passwords started spreading in other attacks

Bokt.nl, a popular forum for horse enthusiasts in the Netherlands, has announced that it has become the victim of a security incident. The forum's owners claim it was an “automated broad-scale attack” that resulted in the leaking of email addresses and hashed passwords.

“Over the past 25 years, there have been thousands of attempts to hack the site and steal data. As far as we know, none of these attempts have ever been successful,” forum owner Bart van Bragt says in a post that was published on the website.

According to the owner, an unknown threat actor exploited a loophole in the forum’s security. As a result, email addresses and hashed passwords for an undisclosed number of users have been stolen. The attacker didn’t exfiltrate any usernames. The stolen data wasn’t used to log in to the forum.

Van Bragt argues that it seems that this was an “automated broad-scale attack” aimed at identifying vulnerabilities in software on the internet. The vulnerability has since been patched, and the attacker has been locked out of the system.

“Stolen data can be sold or used to break into other sites; we have indications that the latter is already happening,” the forum owner warns. That’s why he recommends that its users immediately change their passwords.

If they use the same passwords on other websites, they should change them there as well to something strong and unique.

Lastly, users are advised to consider a password manager like Proton Pass, Bitwarden, or 1Password.

“The built-in password manager of your browser or operating system also works fine,” Van Bragt says.

Users who don’t change their password will be forced to do so as the forum will perform an automatic reset “shortly.”

Van Bragt says the site’s code is currently under review. In addition, the site’s firewall is beefed up, and detection systems are being expanded. The incident has been reported to the Dutch privacy and data protection authority. Affected users have been informed by email.

Unlock more exclusive Cybernews content on YouTube.