Hackers steal customer data from Russian hosting provider FirstVDS

[Gareth84]

Russian hosting provider FirstVDS has disclosed a serious breach. The Record's Daryna Antoniuk reports that attackers exploited a flaw in VMmanager 6, a virtualisation platform made by Russian vendor ISPsystem. The breach was discovered on Saturday

The attackers deployed malware that mounted customer disks in read only mode and copied sensitive files to a server they controlled. The stolen data included passwords, cloud credentials, configuration files and cryptocurrency wallets

FirstVDS, which has operated since 2002, says only part of its infrastructure was affected, but it has not said how many customers or servers were hit. It cut external access to its management system and blocked the attackers' server, and was still running with restrictions on Monday

ISPsystem has released several patches, the latest overnight, but FirstVDS says the flaw is not fully fixed yet. Customers who received a notification are being told to change all their credentials, which is the right advice

Attacks on hosting platforms are especially damaging because one flaw can expose many customers at once. It is a similar pattern to the ConnectWise incident, where a trusted management tool became the way in. Anyone using VMmanager should check for updates and rotate credentials

How much do you trust your hosting provider's management tools? And should providers disclose more detail about breaches?

Hackers steal customer data from major Russian hosting provider FirstVDStherecord.media