A server hosting a community site that markets the open-source Firefox browser was hacked July 10, apparently to send spam, the Mozilla Foundation said.
Remote attackers exploited a vulnerability in the software running the Spread Firefox site, according to an email the foundation sent users of the site. Mozilla discovered the breach Tuesday.
"We don't have any evidence that the attackers obtained personal information about site users, and we believe they accessed the machine to use it to send spam," the foundation wrote. "However, it is possible that the attackers acquired information site users provided to the site."
Mozilla advised users of the site to change their Spread Firefox password and any account passwords where they use that same Spread Firefox password.
The attack did not affect other Mozilla web sites or Mozilla software, according to the foundation. The Spread Firefox site was down for a few days while the breach was investigated, according to a blog on the site.
"The Mozilla foundation deeply regrets this incident and is taking steps to prevent it from happening again," the email concluded. "We have applied the necessary security fixes to the software running the site, have reviewed our security plan to determine why we didn't previously apply those fixes in this case, and have modified that plan to ensure we do so in the future."
