The site had to close briefly while the attack was cleaned up. It is not known whether the attack was an attempt to place Trojan software on the site or to use the accounts of registered users as a spam directory.
"It appears that a part of Spread Firefox was hacked in an attempt to use it to send out spam," said Asa Dotzlerin on the site's blog.
"It doesn't look like the attacker accessed any personal data on the site, but to be safe we're encouraging all our users to log in and change their passwords.
"If you have an account with Spread Firefox, you probably received an email about this with instructions for updating your password."
The site stores details of members' email and instant messaging accounts, along with street names and birthdays.
Spread Firefox raised more than $200,000 last December for a two-page ad for Firefox in The New York Times and has a claimed membership of about 100,000.
Facebook told by Brussels-based court to stop tracking non-users and to delete all data held on them
Supply chain and manufacturing experience could give Dyson an important edge
New VR Zone Portal arcades open in London and Tunbridge Wells
Systems-on-a-chip with integrated AI features could make voice and facial recognition