Letbox hack/outage

tetech

From https://my.letbox.com/serverstatus.php

Outage / High Loads - Virtualization (VPS) Platform. Node Specific.

Many VPS nodes down for base O/S re-installation to clean up from prior DDOS/hacker issues and secure systems. Service will be restored per node as each process completed.

UPDATE:

We are currently working to restore service to nodes affected from prior ddos/hack issues.

While working smoothly one server at a time to clean up the prior issue, the hacker got angry and decided to corrupt the O/S on all systems he/she/they still could get to that were not re-installed/patched yet.

We are now scrambling to re-install all those nodes, and have been at it non-stop since last night.

The good news is, there has been no breach to any re-install nodes with the most recent version/patch we have been using for weeks now, so it is just a matter of working thru the platform to re-install/patch each and every node.

We do not have an ETA for full resolution yet, but all services should be restored today at some point, with nodes coming on line one by one as completed.

arirang

Up/Down repeatedly for a long time and a while ago but there's no notification such as above one.
Recently they sent out email few minute ago before Host node reinstall without a detail reason.
Very unprofessional and I don't think they do care their servers and even monitor their server.
I'm not review any vms at Letbox, Smarthost

FrankZ

@tetech said: From https://my.letbox.com/serverstatus.php

That does not look good at all. Thanks a lot for posting this.

Otus9051

@arirang said:
Up/Down repeatedly for a long time and a while ago but there's no notification such as above one.
Recently they sent out email few minute ago before Host node reinstall without a detail reason.
Very unprofessional and I don't think they do care their servers and even monitor their server.
I'm not review any vms at Letbox, Smarthost

treesmokah

It is related to https://lowendspirit.com/discussion/7088/cloudie-networks-llc-data-leakage
Attacker claimed he compromised SmartHost/LetBox and their other brands, however he stated he wont release the data because they "acted right" which could mean informing clients of the breach, which they didn't do.

It leads me to believe they have paid the ransom and are trying to downplay the severity of this whole mess.
Or they are fucking insane and are "fighting" with the attacker while not telling their customers anything.

Either way, I would never do business with them. They are absolutely incompetent and do not care about their customers security.

yoursunny

The end is nigh.

skorous

@treesmokah said:
It is related to https://lowendspirit.com/discussion/7088/cloudie-networks-llc-data-leakage
Attacker claimed he compromised SmartHost/LetBox and their other brands, however he stated he wont release the data because they "acted right" which could mean informing clients of the breach, which they didn't do.

It leads me to believe they have paid the ransom and are trying to downplay the severity of this whole mess.
Or they are fucking insane and are "fighting" with the attacker while not telling their customers anything.

Either way, I would never do business with them. They are absolutely incompetent and do not care about their customers security.

It's definitely not a good luck, for sure.

Calypso

I'm pretty pissed at this provider. Hours of downtime and issues during the last couple of weeks. The mentioned downtime was already on it's way for hours and I created a ticket for it (first hours website wasn't even reachable), but never got an answer. At that time, literally zero mention of this on the website or service status - according to the latter everything was up and running. Maybe because they restored the website from backup or something. But on the other hand: haven't seen anything on mail from them about it.

Yes, I can imagine that you have a priority to get the hacker out, and repair stuff, but on the other side of things: communicate with your users. I haven't seen anything. If a hacker has gained access to your systems, you should always keep your customers informed - that's even mandatory in a lot of countries.

yusra

Is this going to be another drama that can be watched with popcorn and snacks?!

_MS_

@yusra said:
Is this going to be another drama that can be watched with popcorn and snacks?!

SMARTHOST

@treesmokah said:
It is related to https://lowendspirit.com/discussion/7088/cloudie-networks-llc-data-leakage
Attacker claimed he compromised SmartHost/LetBox and their other brands, however he stated he wont release the data because they "acted right" which could mean informing clients of the breach, which they didn't do.

It leads me to believe they have paid the ransom and are trying to downplay the severity of this whole mess.
Or they are fucking insane and are "fighting" with the attacker while not telling their customers anything.

Either way, I would never do business with them. They are absolutely incompetent and do not care about their customers security.

Wrong.
That issue in our network status posting has absolutely nothing to do with the issue plaguing the the industry currently whatsoever.
You are making assumptions, and are quire incorrect.
At no time have we paid any ransom whatsoever.
This is basically libel.

~ SMARTHOST

skorous

@SMARTHOST said:

@treesmokah said:
It is related to https://lowendspirit.com/discussion/7088/cloudie-networks-llc-data-leakage
Attacker claimed he compromised SmartHost/LetBox and their other brands, however he stated he wont release the data because they "acted right" which could mean informing clients of the breach, which they didn't do.

It leads me to believe they have paid the ransom and are trying to downplay the severity of this whole mess.
Or they are fucking insane and are "fighting" with the attacker while not telling their customers anything.

Either way, I would never do business with them. They are absolutely incompetent and do not care about their customers security.

Wrong.
That issue in our network status posting has absolutely nothing to do with the issue plaguing the the industry currently whatsoever.
You are making assumptions, and are quire incorrect.
At no time have we paid any ransom whatsoever.
This is basically libel.

~ SMARTHOST

Was any notification sent out about the breach? I don't think I got one.

treesmokah

@skorous said:

@SMARTHOST said:

@treesmokah said:
It is related to https://lowendspirit.com/discussion/7088/cloudie-networks-llc-data-leakage
Attacker claimed he compromised SmartHost/LetBox and their other brands, however he stated he wont release the data because they "acted right" which could mean informing clients of the breach, which they didn't do.

It leads me to believe they have paid the ransom and are trying to downplay the severity of this whole mess.
Or they are fucking insane and are "fighting" with the attacker while not telling their customers anything.

Either way, I would never do business with them. They are absolutely incompetent and do not care about their customers security.

Wrong.
That issue in our network status posting has absolutely nothing to do with the issue plaguing the the industry currently whatsoever.
You are making assumptions, and are quire incorrect.
At no time have we paid any ransom whatsoever.
This is basically libel.

~ SMARTHOST

Was any notification sent out about the breach? I don't think I got one.

Nobody got one, I talked to their customers about it.

skorous

@treesmokah said:

Nobody got one, I talked to their customers about it.

Presumably a small sunset of customers. I was hoping for an official statement.

SMARTHOST

@Calypso said:
Yes, I can imagine that you have a priority to get the hacker out, and repair stuff, but on the other side of things: communicate with your users. I haven't seen anything. If a hacker has gained access to your systems, you should always keep your customers informed - that's even mandatory in a lot of countries.

So...I suppose the network status incident that we kept updated non-stop, and quoted by the OP even in this thread, didn't exist?
What is with people these days...making assumptions without any knowledge, and not even capable of reading.

Let me help you out:
The OP posted info from our network status information that was consistently updated with what status and steps were being taken regarding a ddos/hack attack our VPS platform was having. We literally posted tons of updates there as it was underway. At this point most of it consolidated and the update by update listing consolidated and/or removed. Clients were fully and non-stop informed here, and pointed to such with any support tickets as well.

This issue has absolutely nothing to do with the current WHMCS module/theme hack issue plaguing the industry.
This was an attack against our VPS platform specifically, and VPS nodes, and did not involve/affect client data.

~ SMARTHOST

treesmokah

@skorous said:

@treesmokah said:

Nobody got one, I talked to their customers about it.

Presumably a small sunset of customers. I was hoping for an official statement.

Entire database of Letbox and SmartHost were dumped. All clients are affected.

SMARTHOST

@treesmokah said:
Entire database of Letbox and SmartHost were dumped. All clients are affected.

Please explain how an attack on VPS nodes/platform can result in a dump of client database.
The OP posted regarding the ddos/hack issue on our VPS platform.
This ddos/hack issue had nothing to do whatsoever with the current WHMCS module/theme hack issue plaguing the industry, and hosting company billing systems.

~ SMARTHOST

treesmokah

@SMARTHOST said:

@treesmokah said:
Entire database of Letbox and SmartHost were dumped. All clients are affected.

Please explain how an attack on VPS nodes/platform can result in a dump of client database.
The OP posted regarding the ddos/hack issue on our VPS platform.
This ddos/hack issue had nothing to do whatsoever with the current WHMCS module/theme hack issue plaguing the industry, and hosting company billing systems.

~ SMARTHOST

Your "ddos" issue started right after attacker claimed to have your database and made demand to have vps reinstalled. There are literally logs of that.

Was your WHMCS compromised? (I know it was but I'd like to hear "official" story).

SMARTHOST

@treesmokah said:
Your "ddos" issue started right after attacker claimed to have your database and made demand to have vps reinstalled. There are literally logs of that.
Was your WHMCS compromised? (I know it was but I'd like to hear "official" story).\

Completely separate issue, and NOT the subject the OP posted about in this thread.
Once you stop confusing/intermingling the two separate issues, maybe you'd understand better.
At no time have we paid any hacker a ransom.
At no time have we re-installed client VPS from such issues.
There was no client data/breach from the ddos/hacks against our VPS platform.
In fact, as far as the issue in this thread the OP was discussing, we did the opposite, and brought in a team of external security consultants to handle the issue.

The WHMCS issue posted in the thread below, is entirely separate, and has ABSOLUTELY nothing to do with the VPS platform issues the OP was posting about in this thread:
https://lowendspirit.com/discussion/7088/cloudie-networks-llc-data-leakage
That was related to completely separate systems, and did NOT involve the VPS platform issues above.
The timing of such actually does NOT correlate between the two issues, just public visibility overlaps to make it appear so.
This issue, atleast for us, involved a 3rd party module issue, but seems to differ with some of many other hosting providers affected by this.
We consulted legal representation regarding this, and specifically acted based on their recommendations/advice.
For safety purposes all client accounts and server passwords were changed en'masse, rendering any potential data obtained worthless.
internal systems were re-installed/cleaned and keys/access changed and locked down to the extreme.
We do not store any highly sensitive data, such as credit card numbers, otherwise that would have changed our course of action, and impacted proactive notification requirements.
Any client that inquired regarding such, was indeed informed passwords were changed for safety due to a potential threat/breach.
From what we understand, the hacker considered this valid action, and therefore left us alone considering it responsible and secure action having been taken, and their threats not ignored.
At no time have we paid any hacker a ransom.

~ SMARTHOST

treesmokah

So you still didn't inform your clients of their personal information and billing details being in hands of unknown criminal actor. Nice.

@SMARTHOST said: Any client that inquired regarding such, was indeed informed passwords were changed for safety due to a potential threat/breach.

What a joke. Client has to ask a provider if they were breached just to get a statement.

treesmokah

@FrankZ @bikegremlin @mikho I will leave it up to staff to decide whether such providers are welcome here or not. Not informing clients of their data being in hands of a known extortionist is a fucking joke.

Even @Cloudie did better than that.

tetech

@SMARTHOST said:

@Calypso said:
Yes, I can imagine that you have a priority to get the hacker out, and repair stuff, but on the other side of things: communicate with your users. I haven't seen anything. If a hacker has gained access to your systems, you should always keep your customers informed - that's even mandatory in a lot of countries.

So...I suppose the network status incident that we kept updated non-stop, and quoted by the OP even in this thread, didn't exist?
What is with people these days...making assumptions without any knowledge, and not even capable of reading.

Let me help you out:
The OP posted info from our network status information that was consistently updated with what status and steps were being taken regarding a ddos/hack attack our VPS platform was having. We literally posted tons of updates there as it was underway. At this point most of it consolidated and the update by update listing consolidated and/or removed. Clients were fully and non-stop informed here, and pointed to such with any support tickets as well.

This issue has absolutely nothing to do with the current WHMCS module/theme hack issue plaguing the industry.
This was an attack against our VPS platform specifically, and VPS nodes, and did not involve/affect client data.

~ SMARTHOST

Hello, I am the OP here. To be clear, my VPS was never reinstalled, and I cannot speak of anything other than the Letbox VPS outage.

What is written above makes it sound like customers were kept well-informed throughout. At least for the first half day, there was complete radio silence and nothing posted on the status page (or anywhere else that I could find). My support ticket was not responded to until several hours after the service was restored. It was only because I checked the status page again after 48 hours that I learned what was going on.

I didn't necessarily expect anything better, but what you have written does not tally with my personal experience.

SMARTHOST

@treesmokah said:
Not informing clients of their data being in hands of a known extortionist is a fucking joke.

Not the case...there we go with assumptions again.
At no time have we stated we will not be proactively informing clientele, only that we have not done so yet.
We have every intention of doing so, once we have all details we need to do so, as it is the right thing to do, regardless of legal representation informing us it was not absolutely required due to the specifics.
There is no reasonable expectation of client harm here, and no sensitive information (credit card numbers, IDs, social security numbers, etc..) was obtained.
Combined with the security actions we have taken in the matter, the notification urgency is limited.
We do expect that we will be sending out notifications shortly, now that we have the information we need to do so, know what was involved and that issues were not related, and have systems patched and service all back to normal.
We have just had our hands full dealing with both issues, and only finally coming up for air, after many sleepless nights dealing with it all.
I don't wish having to deal with something like this on our biggest competitors, this was not pleasant and as stressful as it gets in this industry.

~ SMARTHOST

SMARTHOST

@treesmokah said:
@FrankZ @bikegremlin @mikho I will leave it up to staff to decide whether such providers are welcome here or not.

Take note you have not seen us on here or other similar forums lately, because we have had our hands full dealing with these two issues. Security and client services being operational has been our only concerns since that time period. Heck, we had minimal Black Friday and year end sales presence, because we were dealing with the VPS platform issues since late November...and that hurts. That was one of the most talented hacker(s) I have seen in my 30+ years in the industry. Hate them, but still impressed by their skills. The WHMCS breach I don't think was as much skill as it was luck or happening across 3rd party software flaw(s). We are finally just this weekend able to come up for air, and start working on next steps beyond security and re-install work.

~ SMARTHOST

SMARTHOST

@tetech said:
Hello, I am the OP here. To be clear, my VPS was never reinstalled, and I cannot speak of anything other than the Letbox VPS outage.
What is written above makes it sound like customers were kept well-informed throughout. At least for the first half day, there was complete radio silence and nothing posted on the status page (or anywhere else that I could find). My support ticket was not responded to until several hours after the service was restored. It was only because I checked the status page again after 48 hours that I learned what was going on.
I didn't necessarily expect anything better, but what you have written does not tally with my personal experience.

We kept it updated as best we could with constant updates, but there were long periods of time where there were no updates to be given. We literally were spending 16-18 hours workdays reinstalling hardware nodes, only to have issues again on same nodes within 24 hours. A combination of trial/error, external security consultant assistance, and software vendor assistance got us to a point of clearing up the issue, but it took alot of time to get there. I've been in this business longer than anyone, and this is the most persistent and talented hacker/attacker I have ever seen. My team had their hands full dealing with it, and we did the best we could keeping clients informed and responding to tickets. We literally had over 1,000 tickets between our brands to respond to about the matter, and were beyond overwhelmed...but we got thru it.

~ SMARTHOST

FrankZ

@treesmokah said:
@FrankZ @bikegremlin @mikho I will leave it up to staff to decide whether such providers are welcome here or not. Not informing clients of their data being in hands of a known extortionist is a fucking joke.

Even @Cloudie did better than that.

My opinion regarding this as a staff member:

The way I see this is that LES is a forum where people talk about things hosting related. Some of the key statements made in this thread by both the members and the provider are not verifiable by LES staff. Both have had their say, and aside from some understandable emotional overtones, everybody has acted reasonably well in their discourse with each other. I do think it was beneficial that the subject was discussed so that current and future members can make their own decisions on the subject. I I do not see the need for any comments to be moderated, members to be warned, or any provider tags to be removed.

Personal opinion based on the statements provided:

I think we all knew once the Cloudie hack became public that something big was going on, and the data we provided to hosting providers was most likely in the wild from one source or another. Working together to mitigate the damage and taking personal responsibility for self protection was the best anyone could do. It's a crap situation for everybody involved both provider and client.

@SMARTHOST has said that this hack was unrelated, and based on my past dealings with him, I have no reason to doubt he is telling the truth. IMO we are not talking about someone with questionable ethics. Hindsight is always 20/20 and I am sure we all can relate to wishing we had acted or said something a little differently in hindsight.

Thai is my four cents.

cold

@treesmokah said:
@FrankZ @bikegremlin @mikho I will leave it up to staff to decide whether such providers are welcome here or not. Not informing clients of their data being in hands of a known extortionist is a fucking joke.

Even @Cloudie did better than that.

If VirTrash is welcome here and tolerated everyone else will be.

bikegremlin

@cold said:

@treesmokah said:
@FrankZ @bikegremlin @mikho I will leave it up to staff to decide whether such providers are welcome here or not. Not informing clients of their data being in hands of a known extortionist is a fucking joke.

Even @Cloudie did better than that.

If VirTrash is welcome here and tolerated everyone else will be.

Some people like to be heavily policed.
Others won't accept any rules.

No one can please everyone.

We are trying to stay free, open, but without allowing for clear frauds and similar.
Sort of a middle-ground.

Not perfect, never will be, but it is what makes this place - with all its pros and cons.

Relja

skorous

@SMARTHOST said: There is no reasonable expectation of client harm here, and no sensitive information (credit card numbers, IDs, social security numbers, etc..) was obtained.

Is that 100% true though? For an indeterminate length of time an unknown actor had access to my account and through that the consoles of my VMs, right?

jarland

@treesmokah said:
It is related to https://lowendspirit.com/discussion/7088/cloudie-networks-llc-data-leakage
Attacker claimed he compromised SmartHost/LetBox and their other brands, however he stated he wont release the data because they "acted right" which could mean informing clients of the breach, which they didn't do.

It leads me to believe they have paid the ransom and are trying to downplay the severity of this whole mess.
Or they are fucking insane and are "fighting" with the attacker while not telling their customers anything.

Either way, I would never do business with them. They are absolutely incompetent and do not care about their customers security.

I’m a bit late to the thread and my brain is scattered a little on the subject. But I wanted to add what seems to me to also be plausible:

That the hacker in question never compromised them at all and simply made a false claim. He doesn’t seem very reliable.

skorous

@jarland said:

@treesmokah said:
It is related to https://lowendspirit.com/discussion/7088/cloudie-networks-llc-data-leakage
Attacker claimed he compromised SmartHost/LetBox and their other brands, however he stated he wont release the data because they "acted right" which could mean informing clients of the breach, which they didn't do.

It leads me to believe they have paid the ransom and are trying to downplay the severity of this whole mess.
Or they are fucking insane and are "fighting" with the attacker while not telling their customers anything.

Either way, I would never do business with them. They are absolutely incompetent and do not care about their customers security.

I’m a bit late to the thread and my brain is scattered a little on the subject. But I wanted to add what seems to me to also be plausible:

That the hacker in question never compromised them at all and simply made a false claim. He doesn’t seem very reliable.

Well there's that pesky customer database dump that was being passed around, right? Or are you thinking that came from a different source?

treesmokah

@jarland said:

@treesmokah said:
It is related to https://lowendspirit.com/discussion/7088/cloudie-networks-llc-data-leakage
Attacker claimed he compromised SmartHost/LetBox and their other brands, however he stated he wont release the data because they "acted right" which could mean informing clients of the breach, which they didn't do.

It leads me to believe they have paid the ransom and are trying to downplay the severity of this whole mess.
Or they are fucking insane and are "fighting" with the attacker while not telling their customers anything.

Either way, I would never do business with them. They are absolutely incompetent and do not care about their customers security.

I’m a bit late to the thread and my brain is scattered a little on the subject. But I wanted to add what seems to me to also be plausible:

That the hacker in question never compromised them at all and simply made a false claim. He doesn’t seem very reliable.

Brother, they literally admitted to getting breached a few posts above it. Its also been confirmed in "providers forum" on OGF, they are in the spreadsheet with other compromised providers.

"SQL Dumped" stands for "leaked", their database is in possession of attackers.

@SMARTHOST said:

@treesmokah said:
@FrankZ @bikegremlin @mikho I will leave it up to staff to decide whether such providers are welcome here or not.

Take note you have not seen us on here or other similar forums lately, because we have had our hands full dealing with these two issues. Security and client services being operational has been our only concerns since that time period. Heck, we had minimal Black Friday and year end sales presence, because we were dealing with the VPS platform issues since late November...and that hurts. That was one of the most talented hacker(s) I have seen in my 30+ years in the industry. Hate them, but still impressed by their skills. The WHMCS breach I don't think was as much skill as it was luck or happening across 3rd party software flaw(s). We are finally just this weekend able to come up for air, and start working on next steps beyond security and re-install work.

~ SMARTHOST

So lets assume "ddos/hack" issue was separate from WHMCS breach "issue".
Its even more embarrassing this way, you got pwned 2 times in the same month. Presumably by 2 different attackers, both getting access to personal information and data of your customers.
First by someone who got access to VM's and client data on it, and then by someone who got access to people personal info from WHMCS.

Absolute fucking shitshow. Worst part is you didn't notify your clients about WHMCS breach, which was at this point close to a month ago. You could've send a notification, you could've submitted the data to HIBP, but you did none of that.

My recommendation from the other thread stays the same, stay away from this provider, they do not take personal information and security seriously. I have no idea what legal regulations are in the State you are located in, but some require to disclose a breach up to 2 weeks.
In EU you would've gotten sued to shit for all of that.

jarland

@skorous said:

@jarland said:

@treesmokah said:
It is related to https://lowendspirit.com/discussion/7088/cloudie-networks-llc-data-leakage
Attacker claimed he compromised SmartHost/LetBox and their other brands, however he stated he wont release the data because they "acted right" which could mean informing clients of the breach, which they didn't do.

It leads me to believe they have paid the ransom and are trying to downplay the severity of this whole mess.
Or they are fucking insane and are "fighting" with the attacker while not telling their customers anything.

Either way, I would never do business with them. They are absolutely incompetent and do not care about their customers security.

I’m a bit late to the thread and my brain is scattered a little on the subject. But I wanted to add what seems to me to also be plausible:

That the hacker in question never compromised them at all and simply made a false claim. He doesn’t seem very reliable.

Well there's that pesky customer database dump that was being passed around, right? Or are you thinking that came from a different source?

I guess I missed that. Tough to keep up. But I still don’t see it in that telegram channel, looking at files going back to Dec 26.

treesmokah

@jarland said:

@skorous said:

@jarland said:

@treesmokah said:
It is related to https://lowendspirit.com/discussion/7088/cloudie-networks-llc-data-leakage
Attacker claimed he compromised SmartHost/LetBox and their other brands, however he stated he wont release the data because they "acted right" which could mean informing clients of the breach, which they didn't do.

It leads me to believe they have paid the ransom and are trying to downplay the severity of this whole mess.
Or they are fucking insane and are "fighting" with the attacker while not telling their customers anything.

Either way, I would never do business with them. They are absolutely incompetent and do not care about their customers security.

I’m a bit late to the thread and my brain is scattered a little on the subject. But I wanted to add what seems to me to also be plausible:

That the hacker in question never compromised them at all and simply made a false claim. He doesn’t seem very reliable.

Well there's that pesky customer database dump that was being passed around, right? Or are you thinking that came from a different source?

I guess I missed that. Tough to keep up. But I still don’t see it in that telegram channel, looking at files going back to Dec 26.

All that was done so far was their WHMCS config and license getting leaked.
Attacker said he wont leak the entire database because "SmartHost notified the customers", I don't think he will be pleased to hear they didn't.

FatGrizzly

@treesmokah said:

@jarland said:

@treesmokah said:
It is related to https://lowendspirit.com/discussion/7088/cloudie-networks-llc-data-leakage
Attacker claimed he compromised SmartHost/LetBox and their other brands, however he stated he wont release the data because they "acted right" which could mean informing clients of the breach, which they didn't do.

It leads me to believe they have paid the ransom and are trying to downplay the severity of this whole mess.
Or they are fucking insane and are "fighting" with the attacker while not telling their customers anything.

Either way, I would never do business with them. They are absolutely incompetent and do not care about their customers security.

I’m a bit late to the thread and my brain is scattered a little on the subject. But I wanted to add what seems to me to also be plausible:

That the hacker in question never compromised them at all and simply made a false claim. He doesn’t seem very reliable.

Brother, they literally admitted to getting breached a few posts above it. Its also been confirmed in "providers forum" on OGF, they are in the spreadsheet with other compromised providers.

"SQL Dumped" stands for "leaked", their database is in possession of attackers.

@SMARTHOST said:

@treesmokah said:
@FrankZ @bikegremlin @mikho I will leave it up to staff to decide whether such providers are welcome here or not.

Take note you have not seen us on here or other similar forums lately, because we have had our hands full dealing with these two issues. Security and client services being operational has been our only concerns since that time period. Heck, we had minimal Black Friday and year end sales presence, because we were dealing with the VPS platform issues since late November...and that hurts. That was one of the most talented hacker(s) I have seen in my 30+ years in the industry. Hate them, but still impressed by their skills. The WHMCS breach I don't think was as much skill as it was luck or happening across 3rd party software flaw(s). We are finally just this weekend able to come up for air, and start working on next steps beyond security and re-install work.

~ SMARTHOST

So lets assume "ddos/hack" issue was separate from WHMCS breach "issue".
Its even more embarrassing this way, you got pwned 2 times in the same month. Presumably by 2 different attackers, both getting access to personal information and data of your customers.
First by someone who got access to VM's and client data on it, and then by someone who got access to people personal info from WHMCS.

Absolute fucking shitshow. Worst part is you didn't notify your clients about WHMCS breach, which was at this point close to a month ago. You could've send a notification, you could've submitted the data to HIBP, but you did none of that.

My recommendation from the other thread stays the same, stay away from this provider, they do not take personal information and security seriously. I have no idea what legal regulations are in the State you are located in, but some require to disclose a breach up to 2 weeks.
In EU you would've gotten sued to shit for all of that.

How did you get access to the spreadsheet?

FatGrizzly

FYI ANYONE.

That spreadsheet is just gathering and findings. We dont know if the attacker gained full access to db/configuration file.

EDIT: Attacker dumped configuration files of Letbox and Smarthost on TG.

treesmokah

@FatGrizzly said:

@treesmokah said:

@jarland said:

@treesmokah said:
It is related to https://lowendspirit.com/discussion/7088/cloudie-networks-llc-data-leakage
Attacker claimed he compromised SmartHost/LetBox and their other brands, however he stated he wont release the data because they "acted right" which could mean informing clients of the breach, which they didn't do.

It leads me to believe they have paid the ransom and are trying to downplay the severity of this whole mess.
Or they are fucking insane and are "fighting" with the attacker while not telling their customers anything.

Either way, I would never do business with them. They are absolutely incompetent and do not care about their customers security.

I’m a bit late to the thread and my brain is scattered a little on the subject. But I wanted to add what seems to me to also be plausible:

That the hacker in question never compromised them at all and simply made a false claim. He doesn’t seem very reliable.

Brother, they literally admitted to getting breached a few posts above it. Its also been confirmed in "providers forum" on OGF, they are in the spreadsheet with other compromised providers.

"SQL Dumped" stands for "leaked", their database is in possession of attackers.

@SMARTHOST said:

@treesmokah said:
@FrankZ @bikegremlin @mikho I will leave it up to staff to decide whether such providers are welcome here or not.

Take note you have not seen us on here or other similar forums lately, because we have had our hands full dealing with these two issues. Security and client services being operational has been our only concerns since that time period. Heck, we had minimal Black Friday and year end sales presence, because we were dealing with the VPS platform issues since late November...and that hurts. That was one of the most talented hacker(s) I have seen in my 30+ years in the industry. Hate them, but still impressed by their skills. The WHMCS breach I don't think was as much skill as it was luck or happening across 3rd party software flaw(s). We are finally just this weekend able to come up for air, and start working on next steps beyond security and re-install work.

~ SMARTHOST

So lets assume "ddos/hack" issue was separate from WHMCS breach "issue".
Its even more embarrassing this way, you got pwned 2 times in the same month. Presumably by 2 different attackers, both getting access to personal information and data of your customers.
First by someone who got access to VM's and client data on it, and then by someone who got access to people personal info from WHMCS.

Absolute fucking shitshow. Worst part is you didn't notify your clients about WHMCS breach, which was at this point close to a month ago. You could've send a notification, you could've submitted the data to HIBP, but you did none of that.

My recommendation from the other thread stays the same, stay away from this provider, they do not take personal information and security seriously. I have no idea what legal regulations are in the State you are located in, but some require to disclose a breach up to 2 weeks.
In EU you would've gotten sued to shit for all of that.

How did you get access to the spreadsheet?

So Biloh didn't tell anyone about the breach?

/s

It was circulating in certain communities for quite some time now, this screenshot is all I have. I had details on exploits used and how to deploy them a long time ago as well
Information should be free. Its on providers for not taking security seriously and not patching in time.
You shouldn't think "providers section" is private in any shape or form, given enough resources anyone can get access to whatever they want. Getting "Host Rep" on non-existent hosting provider isn't hard either.

@FatGrizzly said:
FYI ANYONE.

That spreadsheet is just gathering and findings. We dont know if the attacker gained full access to db/configuration file.

EDIT: Attacker dumped configuration files of Letbox and Smarthost on TG.

Its safe to assume all passwords and keys are changed already, so I'm posting this screenshot.

FatGrizzly

@treesmokah said:

@FatGrizzly said:

@treesmokah said:

@jarland said:

@treesmokah said:
It is related to https://lowendspirit.com/discussion/7088/cloudie-networks-llc-data-leakage
Attacker claimed he compromised SmartHost/LetBox and their other brands, however he stated he wont release the data because they "acted right" which could mean informing clients of the breach, which they didn't do.

It leads me to believe they have paid the ransom and are trying to downplay the severity of this whole mess.
Or they are fucking insane and are "fighting" with the attacker while not telling their customers anything.

Either way, I would never do business with them. They are absolutely incompetent and do not care about their customers security.

I’m a bit late to the thread and my brain is scattered a little on the subject. But I wanted to add what seems to me to also be plausible:

That the hacker in question never compromised them at all and simply made a false claim. He doesn’t seem very reliable.

Brother, they literally admitted to getting breached a few posts above it. Its also been confirmed in "providers forum" on OGF, they are in the spreadsheet with other compromised providers.

"SQL Dumped" stands for "leaked", their database is in possession of attackers.

@SMARTHOST said:

@treesmokah said:
@FrankZ @bikegremlin @mikho I will leave it up to staff to decide whether such providers are welcome here or not.

Take note you have not seen us on here or other similar forums lately, because we have had our hands full dealing with these two issues. Security and client services being operational has been our only concerns since that time period. Heck, we had minimal Black Friday and year end sales presence, because we were dealing with the VPS platform issues since late November...and that hurts. That was one of the most talented hacker(s) I have seen in my 30+ years in the industry. Hate them, but still impressed by their skills. The WHMCS breach I don't think was as much skill as it was luck or happening across 3rd party software flaw(s). We are finally just this weekend able to come up for air, and start working on next steps beyond security and re-install work.

~ SMARTHOST

So lets assume "ddos/hack" issue was separate from WHMCS breach "issue".
Its even more embarrassing this way, you got pwned 2 times in the same month. Presumably by 2 different attackers, both getting access to personal information and data of your customers.
First by someone who got access to VM's and client data on it, and then by someone who got access to people personal info from WHMCS.

Absolute fucking shitshow. Worst part is you didn't notify your clients about WHMCS breach, which was at this point close to a month ago. You could've send a notification, you could've submitted the data to HIBP, but you did none of that.

My recommendation from the other thread stays the same, stay away from this provider, they do not take personal information and security seriously. I have no idea what legal regulations are in the State you are located in, but some require to disclose a breach up to 2 weeks.
In EU you would've gotten sued to shit for all of that.

How did you get access to the spreadsheet?

So Biloh didn't tell anyone about the breach?

/s

It was circulating in certain communities for quite some time now, this screenshot is all I have. I had details on exploits used and how to deploy them a long time ago as well
Information should be free. Its on providers for not taking security seriously and not patching in time.
You shouldn't think "providers section" is private in any shape or form, given enough resources anyone can get access to whatever they want. Getting "Host Rep" on non-existent hosting provider isn't hard either.

@FatGrizzly said:
FYI ANYONE.

That spreadsheet is just gathering and findings. We dont know if the attacker gained full access to db/configuration file.

EDIT: Attacker dumped configuration files of Letbox and Smarthost on TG.

Its safe to assume all passwords and keys are changed already, so I'm posting this screenshot.

censor parts of credentials, else you're going against rules of LES. Stay safe lol

cybertech

@FatGrizzly said:
FYI ANYONE.

That spreadsheet is just gathering and findings. We dont know if the attacker gained full access to db/configuration file.

EDIT: Attacker dumped configuration files of Letbox and Smarthost on TG.

is this proof that letbox got hacked?

treesmokah

@FatGrizzly said:

@treesmokah said:

@FatGrizzly said:

@treesmokah said:

@jarland said:

@treesmokah said:
It is related to https://lowendspirit.com/discussion/7088/cloudie-networks-llc-data-leakage
Attacker claimed he compromised SmartHost/LetBox and their other brands, however he stated he wont release the data because they "acted right" which could mean informing clients of the breach, which they didn't do.

It leads me to believe they have paid the ransom and are trying to downplay the severity of this whole mess.
Or they are fucking insane and are "fighting" with the attacker while not telling their customers anything.

Either way, I would never do business with them. They are absolutely incompetent and do not care about their customers security.

I’m a bit late to the thread and my brain is scattered a little on the subject. But I wanted to add what seems to me to also be plausible:

That the hacker in question never compromised them at all and simply made a false claim. He doesn’t seem very reliable.

Brother, they literally admitted to getting breached a few posts above it. Its also been confirmed in "providers forum" on OGF, they are in the spreadsheet with other compromised providers.

"SQL Dumped" stands for "leaked", their database is in possession of attackers.

@SMARTHOST said:

@treesmokah said:
@FrankZ @bikegremlin @mikho I will leave it up to staff to decide whether such providers are welcome here or not.

Take note you have not seen us on here or other similar forums lately, because we have had our hands full dealing with these two issues. Security and client services being operational has been our only concerns since that time period. Heck, we had minimal Black Friday and year end sales presence, because we were dealing with the VPS platform issues since late November...and that hurts. That was one of the most talented hacker(s) I have seen in my 30+ years in the industry. Hate them, but still impressed by their skills. The WHMCS breach I don't think was as much skill as it was luck or happening across 3rd party software flaw(s). We are finally just this weekend able to come up for air, and start working on next steps beyond security and re-install work.

~ SMARTHOST

So lets assume "ddos/hack" issue was separate from WHMCS breach "issue".
Its even more embarrassing this way, you got pwned 2 times in the same month. Presumably by 2 different attackers, both getting access to personal information and data of your customers.
First by someone who got access to VM's and client data on it, and then by someone who got access to people personal info from WHMCS.

Absolute fucking shitshow. Worst part is you didn't notify your clients about WHMCS breach, which was at this point close to a month ago. You could've send a notification, you could've submitted the data to HIBP, but you did none of that.

My recommendation from the other thread stays the same, stay away from this provider, they do not take personal information and security seriously. I have no idea what legal regulations are in the State you are located in, but some require to disclose a breach up to 2 weeks.
In EU you would've gotten sued to shit for all of that.

How did you get access to the spreadsheet?

So Biloh didn't tell anyone about the breach?

/s

It was circulating in certain communities for quite some time now, this screenshot is all I have. I had details on exploits used and how to deploy them a long time ago as well
Information should be free. Its on providers for not taking security seriously and not patching in time.
You shouldn't think "providers section" is private in any shape or form, given enough resources anyone can get access to whatever they want. Getting "Host Rep" on non-existent hosting provider isn't hard either.

@FatGrizzly said:
FYI ANYONE.

That spreadsheet is just gathering and findings. We dont know if the attacker gained full access to db/configuration file.

EDIT: Attacker dumped configuration files of Letbox and Smarthost on TG.

Its safe to assume all passwords and keys are changed already, so I'm posting this screenshot.

censor parts of credentials, else you're going against rules of LES. Stay safe lol

There is no way they are this dumb and didn't change it. If they didn't, oh well.
All I'm posting is a wall of meaningless text. Everything is public.

edit, censored.

jarland

@cybertech said:

@FatGrizzly said:
FYI ANYONE.

That spreadsheet is just gathering and findings. We dont know if the attacker gained full access to db/configuration file.

EDIT: Attacker dumped configuration files of Letbox and Smarthost on TG.

is this proof that letbox got hacked?

Probably. But if you wanted to play devil's advocate, faking a configuration.php file would be like no effort. So, to be fair, probably based on what we've seen thus far but it's not impossible that they didn't.

Brueggus

This just arrived. No message from LetBox so far.

Notice of Cybersecurity Incident
Attn: John Doe -
We are writing to notify you of a recent event that may have impacted your personal information.
At this time, we have no indication of fraudulent use of your personal information as a result of this incident.
Nevertheless, we are notifying you out of an abundance of caution to explain the circumstances as we understand them.
What Happened
SmartHost LLC recently became aware in late December 2023 of a cybersecurity incident impacting its client/billing platform.
An individual(s) accessed SmartHost's client/billing system administrative areas without authorization, including gaining access via a 3rd party vendor module.
The individual(s) claimed to have downloaded customer data from SmartHost's computer systems, then threatened to post and disclose the data on an Internet forum.
Upon being made initially aware of a potential breach, SmartHost immediately began an investigation into the incident.
Although no data has been released that we have seen by this individual(s) as of this time, SmartHost has determined the client/billing system was indeed breached.
What information was potentially accessed?
The compromised data would include client names, address information, phone numbers, email addresses, user names, and account/service passwords
SmartHost does not store financial information on this platform, such as credit/debit card information, which would be stored directly with our 3rd party credit card processor.
SmartHost does not have any more sensitive information about our client base such as financial information, social security numbers, ID numbers, drivers license information, etc...
What We Are Doing
We take the security of our customers’ data seriously, and after SmartHost became aware of the event, we took immediate measures to investigate and remediate the incident.
We have implemented additional safeguards to improve security related to 3rd party software/modules, and the client/billing platform as a whole.
When SmartHost was made aware of the potential breach, we immediately performed global password resets for all client accounts and the server/service passwords that we could.
We also updated all internal system access methods/connectivity.
We have also hired external security consultants to review the matter and assist as well.
Please be assured that we take data security and confidentiality very seriously.
Steps SmartHost has taken to implement additional layers of security (not necessarily in this order):
Identified/removed the primary vulnerability associated with this incident
Global password resets for all users/systems
Update platform security settings and access credentials
Collaborated with cybersecurity specialists to review the situation
Reinstall clean system platform
Notified client base about the incident
Strengthen login credentials/methods and continue to enhance login protocols/procedures and other security measures
Continuing to monitor the situation and investigate this incident
Why did it take SmartHost so long to notify me about this?
SmartHost’s investigation is ongoing. As soon as SmartHost learned that its environment had been accessed by an unauthorized party, SmartHost immediately commenced the investigation, including working with third-party security consultants. System lockdowns were immediately implemented even before we could completely verify the breach. Simultaneously, SmartHost was dealing with another security issue at the same time, including DDOS/hack attempts against our VPS service platform, and we were unsure how/if the two issues were related. It took some time to diagnose, and we have only recently concluded by our staff, external security consultants, and software vendors, that they were unrelated issues.
Do you know who accessed the information illegally?
No, the identity of the individual(s) responsible for this incident is still being investigated; however, they refer to themselves as "Scavenger" and the "whmcssec" team.
Is the stolen information being misused?
At this time, there is no evidence that your information has been misused.
SmartHost has not received any reports of misuse of specific individual’s personal information as a result of this incident.
We understand that this same individual(s) have conducted systematic similar breaches recently of hundreds of other web hosting providers in the industry.
It is our understanding that the system breach was done to prove a point, and force hosting providers to make security policy/procedure changes.
Does this mean I am a victim of identity theft or identity fraud?
No. This means that some personal information is in the hands of unauthorized individual(s), and they could use it to commit identity theft or identity fraud.
If you believe you are the victim of identity theft or fraud, you should immediately report it to local law enforcement.
What You Can Do
There is no reason to believe that you need to take necessary action at this time regarding the personal contact information.
We do recommend again changing your login passwords to the client/billing interface, and to any server/system provided with your SmartHost service, in case global resets did not complete such.
We also recommend implementing two-factor authentication (2FA) on your account, if not done so already, which can be done at:
https://www.smarthost.net/index.php?rp=/user/security
As a best practice, we recommend you remain vigilant and promptly report any suspicious activity, or suspected identity theft, to the proper law enforcement authorities and financial and banking service providers.
On behalf of SmartHost, we apologize for this security breach and for any concern this may have caused.
We have subsequently taken, and continue to take, a number actions to ensure that this incident is thoroughly resolved, and to minimize the risk of a similar incident recurring
If you have any further questions, you are welcome to contact us by responding to this email notification.
SmartHost LLC
Henderson, NV USA
http://smarthost.net
[email protected]

Encoders

@Brueggus said:
This just arrived. No message from LetBox so far.

Notice of Cybersecurity Incident
Attn: John Doe -
We are writing to notify you of a recent event that may have impacted your personal information.
At this time, we have no indication of fraudulent use of your personal information as a result of this incident.
Nevertheless, we are notifying you out of an abundance of caution to explain the circumstances as we understand them.
What Happened
SmartHost LLC recently became aware in late December 2023 of a cybersecurity incident impacting its client/billing platform.
An individual(s) accessed SmartHost's client/billing system administrative areas without authorization, including gaining access via a 3rd party vendor module.

(...snip...)

should've done this from the start. no need to do mental gymnastic until getting called out by treesmokah lol.

LowEndDisclosure

treesmokah

@Brueggus said:
This just arrived. No message from LetBox so far.

Notice of Cybersecurity Incident
Attn: John Doe -
We are writing to notify you of a recent event that may have impacted your personal information.
At this time, we have no indication of fraudulent use of your personal information as a result of this incident.
Nevertheless, we are notifying you out of an abundance of caution to explain the circumstances as we understand them.
What Happened
SmartHost LLC recently became aware in late December 2023 of a cybersecurity incident impacting its client/billing platform.
An individual(s) accessed SmartHost's client/billing system administrative areas without authorization, including gaining access via a 3rd party vendor module.
The individual(s) claimed to have downloaded customer data from SmartHost's computer systems, then threatened to post and disclose the data on an Internet forum.
Upon being made initially aware of a potential breach, SmartHost immediately began an investigation into the incident.
Although no data has been released that we have seen by this individual(s) as of this time, SmartHost has determined the client/billing system was indeed breached.
What information was potentially accessed?
The compromised data would include client names, address information, phone numbers, email addresses, user names, and account/service passwords
SmartHost does not store financial information on this platform, such as credit/debit card information, which would be stored directly with our 3rd party credit card processor.
SmartHost does not have any more sensitive information about our client base such as financial information, social security numbers, ID numbers, drivers license information, etc...
What We Are Doing
We take the security of our customers’ data seriously, and after SmartHost became aware of the event, we took immediate measures to investigate and remediate the incident.
We have implemented additional safeguards to improve security related to 3rd party software/modules, and the client/billing platform as a whole.
When SmartHost was made aware of the potential breach, we immediately performed global password resets for all client accounts and the server/service passwords that we could.
We also updated all internal system access methods/connectivity.
We have also hired external security consultants to review the matter and assist as well.
Please be assured that we take data security and confidentiality very seriously.
Steps SmartHost has taken to implement additional layers of security (not necessarily in this order):
Identified/removed the primary vulnerability associated with this incident
Global password resets for all users/systems
Update platform security settings and access credentials
Collaborated with cybersecurity specialists to review the situation
Reinstall clean system platform
Notified client base about the incident
Strengthen login credentials/methods and continue to enhance login protocols/procedures and other security measures
Continuing to monitor the situation and investigate this incident
Why did it take SmartHost so long to notify me about this?
SmartHost’s investigation is ongoing. As soon as SmartHost learned that its environment had been accessed by an unauthorized party, SmartHost immediately commenced the investigation, including working with third-party security consultants. System lockdowns were immediately implemented even before we could completely verify the breach. Simultaneously, SmartHost was dealing with another security issue at the same time, including DDOS/hack attempts against our VPS service platform, and we were unsure how/if the two issues were related. It took some time to diagnose, and we have only recently concluded by our staff, external security consultants, and software vendors, that they were unrelated issues.
Do you know who accessed the information illegally?
No, the identity of the individual(s) responsible for this incident is still being investigated; however, they refer to themselves as "Scavenger" and the "whmcssec" team.
Is the stolen information being misused?
At this time, there is no evidence that your information has been misused.
SmartHost has not received any reports of misuse of specific individual’s personal information as a result of this incident.
We understand that this same individual(s) have conducted systematic similar breaches recently of hundreds of other web hosting providers in the industry.
It is our understanding that the system breach was done to prove a point, and force hosting providers to make security policy/procedure changes.
Does this mean I am a victim of identity theft or identity fraud?
No. This means that some personal information is in the hands of unauthorized individual(s), and they could use it to commit identity theft or identity fraud.
If you believe you are the victim of identity theft or fraud, you should immediately report it to local law enforcement.
What You Can Do
There is no reason to believe that you need to take necessary action at this time regarding the personal contact information.
We do recommend again changing your login passwords to the client/billing interface, and to any server/system provided with your SmartHost service, in case global resets did not complete such.
We also recommend implementing two-factor authentication (2FA) on your account, if not done so already, which can be done at:
https://www.smarthost.net/index.php?rp=/user/security
As a best practice, we recommend you remain vigilant and promptly report any suspicious activity, or suspected identity theft, to the proper law enforcement authorities and financial and banking service providers.
On behalf of SmartHost, we apologize for this security breach and for any concern this may have caused.
We have subsequently taken, and continue to take, a number actions to ensure that this incident is thoroughly resolved, and to minimize the risk of a similar incident recurring
If you have any further questions, you are welcome to contact us by responding to this email notification.
SmartHost LLC
Henderson, NV USA
http://smarthost.net
[email protected]

Well written Email, all I can say.

remy

I've also received a message concerning the hack from letbox.
I didn't intend to renew my services because of the lack of communication,now I'm hesitating.

treesmokah

@remy said: I didn't intend to renew my services because of the lack of communication,now I'm hesitating.

If you are thinking about it, I'm sorry, but there is no hope for you.
I don't want to be mean, but after all of this shitshow, buying anything from them is the last thing I would be thinking of.

Do whatever you like, stay safe. There is no shortage of good providers for similar money.

cybertech

@Brueggus said:
This just arrived. No message from LetBox so far.

Notice of Cybersecurity Incident
Attn: John Doe -
We are writing to notify you of a recent event that may have impacted your personal information.
At this time, we have no indication of fraudulent use of your personal information as a result of this incident.
Nevertheless, we are notifying you out of an abundance of caution to explain the circumstances as we understand them.
What Happened
SmartHost LLC recently became aware in late December 2023 of a cybersecurity incident impacting its client/billing platform.
An individual(s) accessed SmartHost's client/billing system administrative areas without authorization, including gaining access via a 3rd party vendor module.
The individual(s) claimed to have downloaded customer data from SmartHost's computer systems, then threatened to post and disclose the data on an Internet forum.
Upon being made initially aware of a potential breach, SmartHost immediately began an investigation into the incident.
Although no data has been released that we have seen by this individual(s) as of this time, SmartHost has determined the client/billing system was indeed breached.
What information was potentially accessed?
The compromised data would include client names, address information, phone numbers, email addresses, user names, and account/service passwords
SmartHost does not store financial information on this platform, such as credit/debit card information, which would be stored directly with our 3rd party credit card processor.
SmartHost does not have any more sensitive information about our client base such as financial information, social security numbers, ID numbers, drivers license information, etc...
What We Are Doing
We take the security of our customers’ data seriously, and after SmartHost became aware of the event, we took immediate measures to investigate and remediate the incident.
We have implemented additional safeguards to improve security related to 3rd party software/modules, and the client/billing platform as a whole.
When SmartHost was made aware of the potential breach, we immediately performed global password resets for all client accounts and the server/service passwords that we could.
We also updated all internal system access methods/connectivity.
We have also hired external security consultants to review the matter and assist as well.
Please be assured that we take data security and confidentiality very seriously.
Steps SmartHost has taken to implement additional layers of security (not necessarily in this order):
Identified/removed the primary vulnerability associated with this incident
Global password resets for all users/systems
Update platform security settings and access credentials
Collaborated with cybersecurity specialists to review the situation
Reinstall clean system platform
Notified client base about the incident
Strengthen login credentials/methods and continue to enhance login protocols/procedures and other security measures
Continuing to monitor the situation and investigate this incident
Why did it take SmartHost so long to notify me about this?
SmartHost’s investigation is ongoing. As soon as SmartHost learned that its environment had been accessed by an unauthorized party, SmartHost immediately commenced the investigation, including working with third-party security consultants. System lockdowns were immediately implemented even before we could completely verify the breach. Simultaneously, SmartHost was dealing with another security issue at the same time, including DDOS/hack attempts against our VPS service platform, and we were unsure how/if the two issues were related. It took some time to diagnose, and we have only recently concluded by our staff, external security consultants, and software vendors, that they were unrelated issues.
Do you know who accessed the information illegally?
No, the identity of the individual(s) responsible for this incident is still being investigated; however, they refer to themselves as "Scavenger" and the "whmcssec" team.
Is the stolen information being misused?
At this time, there is no evidence that your information has been misused.
SmartHost has not received any reports of misuse of specific individual’s personal information as a result of this incident.
We understand that this same individual(s) have conducted systematic similar breaches recently of hundreds of other web hosting providers in the industry.
It is our understanding that the system breach was done to prove a point, and force hosting providers to make security policy/procedure changes.
Does this mean I am a victim of identity theft or identity fraud?
No. This means that some personal information is in the hands of unauthorized individual(s), and they could use it to commit identity theft or identity fraud.
If you believe you are the victim of identity theft or fraud, you should immediately report it to local law enforcement.
What You Can Do
There is no reason to believe that you need to take necessary action at this time regarding the personal contact information.
We do recommend again changing your login passwords to the client/billing interface, and to any server/system provided with your SmartHost service, in case global resets did not complete such.
We also recommend implementing two-factor authentication (2FA) on your account, if not done so already, which can be done at:
https://www.smarthost.net/index.php?rp=/user/security
As a best practice, we recommend you remain vigilant and promptly report any suspicious activity, or suspected identity theft, to the proper law enforcement authorities and financial and banking service providers.
On behalf of SmartHost, we apologize for this security breach and for any concern this may have caused.
We have subsequently taken, and continue to take, a number actions to ensure that this incident is thoroughly resolved, and to minimize the risk of a similar incident recurring
If you have any further questions, you are welcome to contact us by responding to this email notification.
SmartHost LLC
Henderson, NV USA
http://smarthost.net
[email protected]

@SMARTHOST care to clarify

remy

@treesmokah said:

@remy said: I didn't intend to renew my services because of the lack of communication,now I'm hesitating.

If you are thinking about it, I'm sorry, but there is no hope for you.
I don't want to be mean, but after all of this shitshow, buying anything from them is the last thing I would be thinking of.

Do whatever you like, stay safe. There is no shortage of good providers for similar money.

Any other provider could have been affected.
I seriously doubt that all low-cost providers have the resources to audit all the plugins they use.

On the other hand, what I would have appreciated was a brief communication to report the incident very quickly and to say that a more complete investigation was underway.
Rather than not communicating anything.

treesmokah

@remy said: Any other provider could have been affected.

They got breached by 2 different actors, in the same month. It requires some "skill".

@remy said: I seriously doubt that all low-cost providers have the resources to audit all the plugins they use.

Define low-cost, there are many great providers with custom non-WHMCS panels, actual security teams and competent developers, and its possible to get them for decent money.
When I see WHMCS my first thought is laziness, I value providers doing stuff on their own and not recycling shit everyone else uses that enables such "supply chain attacks".

Relying on proprietary panel, billing, provisioning systems, and so on with your entire business is the last thing I would do. Especially when WHMCS is known to not be very secure, and its always been like that.
As a host the least you could do is offer unique experience by providing custom software, especially as a VPS provider.

All of this is my personal opinion and you are of course free to think otherwise. There are providers who took steps to assure their WHMCS is secure and even if anything was breached, there is basically nothing in the database besides random emails.

@remy said: On the other hand, what I would have appreciated was a brief communication to report the incident very quickly and to say that a more complete investigation was underway.
Rather than not communicating anything.

This is the most "proper" way to handle it, and its been like that in "corporate" world for a long time.
Its the best you can do really, as soon as you spot a leakage, immediately let your customers know so they can act accordingly.

I'm not gonna pretend I'm a lawyer, but there are certain regulations in most States and Countries which specify time until which you have to let your customers know. The most time that was given in US, from what I remember, was 2 weeks, and SmartHost/Letbox took a month.

And its not like they spotted it themselves, the attacker did his best to reach them, despite being ignored at first. If not that, I bet they wouldn't know it happened to this day.

Richard

Just going to say I think the notification arriving so late is disappointing. Grateful that something finally has gone out, but once the issue was identified and initial remediations in place, customers should have been notified. You don’t need all information at hand and I believe it’s better to notify there appears to be an incident but you don’t yet understand the extent, than say nothing. Perhaps the status page was being used as a communication tool, but I had no reason to be accessing that without prior notice directing my attention there for updates.

treesmokah

@Richard said: Perhaps the status page was being used as a communication tool, but I had no reason to be accessing that without prior notice directing my attention there for updates.

Just to clarify, information on status page was related to the first hack, there was no information anywhere about WHMCS breach. This email is the first official mention of it.