Russian Hosting Provider FirstVDS Breached: Customer Passwords and Credentials Stolen Through Server Management Flaw

Hackers have stolen passwords, access credentials and other sensitive data from customers of Russian hosting provider FirstVDS, the company said. The attack was discovered on Saturday and affected part of its infrastructure. The attackers exploited a vulnerability in VMmanager 6, a platform from ISPsystem that hosting providers use to manage virtual machines across multiple physical servers.

According to FirstVDS, the attackers deployed malware that copied data from customers' virtual servers to a server they controlled. The stolen files included passwords, cloud service credentials, configuration files and cryptocurrency wallets. The malware mounted the disks in read-only mode, so it could copy information without changing files or disrupting normal operations. The company said there are no traces of the attack on the affected servers, which continue to run normally. FirstVDS did not say how many customers or servers were compromised.

FirstVDS told customers who received breach notifications to assume their data was stolen and to change passwords and access credentials. It has disabled external access to the vulnerable management system and blocked communication with the attackers' server. ISPsystem has released several patches, including one overnight on Monday, but FirstVDS said the vulnerability has not yet been fully fixed. This is only the opening of the reported story, and further details may emerge.