-
Hackers stole passwords, cloud keys, and crypto wallets from some FirstVDS customers’ virtual servers.
-
The attackers used a flaw in VMmanager 6, and the affected servers kept running normally.
-
FirstVDS told customers who got a notice to assume the data was copied and to change their passwords.
Hackers have stolen private customer data from FirstVDS, a Russian hosting company. They got in through a flaw in VMmanager 6, a server virtualisation management platform made by ISPsystem. Hosting companies use this platform to run many virtual servers on physical machines.
According to the company, the stolen files included passwords, cloud credentials, configuration files, and cryptocurrency wallets. Some customers kept these files on their virtual servers.
FirstVDS shared the news over the weekend. The company found the unauthorized access on October 17. The attackers copied customer data, yet the affected servers kept running normally. Reports say the attackers reached only part of the company’s infrastructure.
Attackers Copy Customer Files Without Stopping Servers
FirstVDS said the attackers used the flaw in VMmanager 6 to get inside part of its infrastructure. The hackers then placed a data-stealing program on the affected infrastructure servers. That program collected information from the virtual disks of customers. Each virtual disk holds the files of one customer’s server.
The program opened each disk in read-only mode. Read-only mode lets a program look at files and copy them, but not edit them. For that reason, the files stayed unchanged. Reports say the attackers sent the stolen data to a server under their control.
The list of stolen items is long. It includes passwords, cloud service credentials, configuration files, and cryptocurrency wallets. Configuration files hold the settings of a server or app. Wallets store digital money, and credentials let people sign in to cloud services. Security reports give a wider list. They also name SSH keys, API credentials, and access tokens as data that may be exposed.
The attackers reached the disks through the hosting system underneath. They did not run their malware inside customer virtual machines. For that reason, the affected servers kept working as usual. FirstVDS said customers would find no traces of the theft inside their own servers. The company said this method hides the copying from the people who own the data.
The company has not said how many customers or servers the attack hit. It has also not shared any totals for the stolen files. Even so, it gave clear advice. Customers who received a breach notice should assume the attackers copied their stored data.
FirstVDS Cuts Outside Access as ISPsystem Releases Updates
FirstVDS took several steps after the discovery. It switched off outside access to the weak management system. It also blocked all contact with the attackers’ server. The company then told affected customers about the breach. It urged them to change their passwords and access credentials. FirstVDS sent these notices directly to the affected customers.
The incident has raised worries about data stored on virtual private servers. A virtual private server is a rented slice of a larger machine. Businesses and individuals use these servers to host websites, apps, databases, and other online services.
Hosting infrastructure can also support criminal operations, as Dutch police did when they shut down a criminal host used for dark web activities. FirstVDS has operated since 2002. It offers hosting in Russia and in other places, including the Netherlands and Kazakhstan.
ISPsystem has released security updates for VMmanager 6 since the attack. Its official changelog lists security fixes from October 18. More security updates followed on October 19 and October 20. These dates fall one to three days after FirstVDS found the breach.
Still, FirstVDS said the flaw was not fully fixed during its first response. The company advised against restoring outside access to the management interface. It wants customers to wait until further updates arrive, as reports on the VMmanager fixes also show.
The changelog is a record of updates from the software maker. It confirms that ISPsystem issued security fixes. It does not show whether the updates solved every part of the flaw. It also does not show whether all affected installations are now safe.
Key Details About the Attack Are Still Unknown
FirstVDS has not shared how the attackers first used the flaw. It has not named the exact software versions affected. It also has not said whether anyone used the stolen data in new attacks. The identities of the attackers remain unknown. Their motives are also unclear.
The case shows a real risk for people who keep sensitive logins on rented servers. A website or app can keep working while attackers copy data from underneath it. This kind of copying may leave no clear signs inside the affected systems.
Customers who received a notice should follow the instructions from FirstVDS. They should change any exposed passwords. They should also cancel keys and tokens that attackers may have copied. Next, they should review access to linked cloud services. They should check other accounts whose logins sat on the affected servers too.
The investigation and the repair work still matter. Bringing servers back to normal does not protect passwords that attackers already copied. Only changed passwords and canceled keys can stop the attackers from using that data.
