[German]Unpleasant information for users of Affinity forums. The operator informs its users that there was a cyber attack on April 6, 2023. It seems that the account of an administrator was compromised, so that the attacker(s) could gain access to the list of members of the forums. In the process, the email addresses associated with the accounts were likely captured, as well as the IP addresses of the forum users.
Advertising
Who/what is Affinity?
Affinity Designer is a graphics and drawing program from the British software manufacturer Serif for creating and editing vector-based graphics. Along with Affinity Photo and Affinity Publisher, it is the third component of the Affinity product family. The software is used by some users as an alternative to Adobe Creative Suite.
The structure and basic functions of Affinity Designer are similar to those of the competitor program Adobe Illustrator. The RGB, CMYK and Lab color spaces are supported. Both open standard file types like PSD as well as PNG and interpret embedded ICC color profiles. Affinity Designer can handle Pantone spot colors and SVG, EPS and PDF/X file formats.
Affinity Forums hacked
A blog reader emailed me (thanks for that) to let me know that the Affinity team was notifying forum members about a cyber incident. The reader was informed as a participant in the Affinity Beta Program. However, there is also a Security Alert dated Thursday, April 13, 2023 on the Affinity forums.
The Affinity forums operator writes that it was discovered that personal data of users of the forums may have been accessed from outside the company during a cyberattack on April 6, 2023. It appears that an administrator's account was compromised, which allowed access to the forums' member list.
Advertising
The data that may have been accessed, according to the operator, is the data in the public forum profile of the participants (e.g., username, number of posts, reputation, date of joining, etc.), but also the email address and the last IP address used, which are normally private. Access to the accounts' passwords was not possible, the operator writes.
The operator cannot say how many of the forum members' email addresses were tapped. Therefore, as a precaution, all members are made aware of the data protection incident. The operators have reported this incident to the UK Information Commissioner's Office (ICO) and have taken immediate steps to make the forum system more secure to avoid this type of attack in the future.
The forum operator believes that affected parties do not need to do anything currently. However, affected parties should pay special attention to phishing emails in the near future, as there is a risk that the captured email addresses and data will be used for such attacks. This is what it says:
One thing you should be especially careful about is possible "phishing" attempts via email. This is when someone contacts you pretending to be us and asks you to change your password or give them other account details. If you have any doubts about whether an email is genuine, do not click on the links in the email. If you want to update your forum account details, type forum.affinity.serif.com into your browser and log into your account from there to be sure.
If you receive a suspicious email that you think might be from this vulnerability (for example, if an email addresses you by your forum username), forum operators ask to be informed.
Advertising
