Scrum.org provides training, assessment and certifications for the Scrum agile software development framework. In an email sent to customers that says “On May 26, 2016, we noticed an issue with the Scrum.org website outgoing mail server.”
— Scrum.org (@Scrumdotorg) May 31, 2016 “Upon investigation, we determined that emails used to communicate initial passwords were not being sent. After further investigation, our information technology professionals discovered that some of our mail server settings had been modified and found one new administrator user account.” “The very next day, we were informed by one of our software vendors that we use to operate the website that their software contained a newly discovered vulnerability, which accounted for the issues we had seen. We immediately confirmed the applicability of the vulnerability and followed all of our vendor’s instructions to ensure the vulnerability was resolved.”
— toxicdata (@toxicdata) May 31, 2016 The organization also warned its users via email that their usernames, email addresses, encrypted passwords, password decryption keys, certification information, and profile pictures might have been stolen by malicious actors. In addition, the organization also pointed out that the incident did not involve any financial details, and that no other information is stored on its servers. However, the website’s operators said that user profile pictures were stolen. It is not unclear how many users are affected by the breach. After carrying out an examination of the problematic email server, the Scrum.org team found out that someone had illegally accessed its server, added a new administrator account, and had made changes to the server settings. Scrum.org patched the vulnerability and the malicious admin account was removed. User passwords have been reset and the website has promised to move to a different software vendor this summer — one that provides better password security. Meanwhile, the company has reset passwords for all its users, who will be prompted to choose a new one the next time they log in.
