Hostinger sofre invasão

[maksol]

https://www.hostinger.com/blog/security-incident-what-you-need-to-know/

 

Security Incident: What You Need To Know

August 25th, 2019

We have reset all Hostinger Client passwords as a precautionary measure following a recent security incident. We are taking this extremely seriously and want to let everyone know what has happened and the immediate steps we have taken to protect our Clients’ security.

During this incident, an unauthorized third party has gained access to our internal system API, one of which had access to hashed passwords and other non-financial data about our customers.

We have restricted the vulnerable system, and such access is no longer available.

We are in contact with the respective authorities.

What happened?

On August 23rd, 2019 we have received informational alerts that one of our servers has been accessed by an unauthorized third party. This server contained an authorization token, which was used to obtain further access and escalate privileges to our system RESTful API Server*. This API Server* is used to query the details about our clients and their accounts.
*[Latest Edit on 2019-08-25 17:43 UTC]

The API database, which includes our Client usernames, emails, hashed passwords, first names and IP addresses have been accessed by an unauthorized third party. The respective database table that holds client data, has information about 14 million Hostinger users.

We have reset all Client passwords as a precautionary security measure

We use a cryptographic hash function to encrypt all our Client passwords. It is a one-way mathematical function that converts your password to a seemingly random sequence of characters. However, as per standard and precautionary security practices, we have reset all Hostinger Client login passwords. We have sent emails to all Hostinger Clients with further information regarding password reset.

Hostinger Client financial data is safe

Payments for Hostinger services are made through authorized and certified third-party payment providers. It means that we never store any payment card or other sensitive Client financial data on our servers and it has not been accessed or compromised.

Hostinger Client websites and data are not affected

We completed a thorough internal investigation. Hostinger Client accounts and data stored on those accounts (websites, domains, hosted emails, etc.) remained untouched and unaffected.

What steps we have taken so far

Following the incident, we have identified the origin of unauthorized access and have taken necessary measures to protect data about our Clients, including mandatory password reset for our Clients and systems within all of our infrastructure.

Furthermore, we have assembled a team of internal and external forensics experts and data scientists to investigate the origin of the incident and increase security measures of all Hostinger operations. As required by law, we are already in contact with the authorities.

The investigation is still in its early stages. All updates regarding this security incident will be posted in this blog, on our status page, and sent directly to our Clients via email and across other channels.

What our Clients can do to further secure their accounts

Following the password reset, we urge our Clients to choose strong passwords that are not utilized on other websites. Clients should be cautious of any unsolicited communications that may ask for your login details, personal information or refer you to a website asking for the above-mentioned information. We also strongly suggest to avoid clicking on the links or downloading attachments from suspicious emails.

We remind our Clients not to use the same passwords on multiple service providers across the web and to generate strong unique passwords with password management tools.

If you have further questions regarding the security of your account, you may contact Hostinger help center which is available 24/7.

We will be updating this blogpost regularly with important updates regarding this security incident.

If you have any further questions, please refer to Hostinger Help center.

For media inquiries, please contact press@hostinger.com.

If you wish to delete your personal data from Hostinger, please contact gdpr@hostinger.com.