Web hosting firm alerts customers to database breach
Just two weeks after reports emerged of one of South Africa’s biggest-ever data leaks, the country's leading web hosting firm, Hetzner, has announced that its customer database has been hacked.
Issuing a statement earlier today, Cape Town-based Hetzner said it had detected unauthorized access to its KonsoleH control panel database.
The SQL injection vulnerability resulted in customer names, telephone numbers, email addresses, domain names, FTP passwords, and bank account details being exposed.
While the vulnerability has now been patched, Hetzner said it was “imperative” that customers update all passwords associated with their web hosting account.
KonsoleH is Hetzner’s proprietary web hosting control panel, which merges all service admin tools into a single, integrated management system.
“We have external forensic investigators on site working with our team,” the company told its customers.
“While KonsoleH admin passwords have not been compromised, we have proactively updated all FTP passwords which were exposed.”
Founded in 1999, Hetzner has grown to become South Africa's leading web hosting company, with 40,000 customers.
Although the KonsoleH database breach raises questions over the provider’s OpSec practices, Hetzner was quick to inform its customers of the hack, issuing an alert in less than 24 hours.
“We understand that this event has shaken your confidence in us,” the group added. “It is our earnest commitment to provide you with a hosting service you can trust.”
The Hetzner breach comes just weeks after reports surfaced of a massive data leak thought to have exposed the personal details of more than 66.3 million South Africans.
A trove of data left on an open server was found to include national identity numbers, full names, gender, ethnicity, home addresses, phone numbers, and email addresses of what one security expert said was “pretty much the entire population” of South Africa.
