Canonical, which develops the Ubuntu operating system, said in a statement Friday that two million usernames, email addresses and IP addresses associated with the Ubuntu Forums were compromised by an anonymous attacker.
The attacker was able to exploit a vulnerability by performing SQL injection in an add-on used by the largest forum software vBulletin.
This gave the attacker access to the forum's databases, but according to the company, he was able to obtain limited user data.
The company's statement emphasizes that no operating system code or data from application repositories was compromised. It also states that the attacker could not write data to the database or gain shell access, and that he was not able to access any other Canonical or Ubuntu services.
After the breach, the servers were formatted, a new operating system was installed, new security measures, new passwords, and according to the company, the forum software has been fully repaired.
The statement added that although the forums use Ubuntu's single sign-on service, passwords are hashed and salted. The statement does not mention which hashing algorithm is used, as some algorithms still in use (such as MD5) are outdated and can be cracked quite easily.
It would be a good idea to immediately change your passwords and enable two-factor authentication.
