Website host Hostinger was attacked by hackers and leaked 14 million users

Recently, the world’s leading web hosting provider & website hoster Hostinger announced that an anonymous attacker has stolen the customer database due to unknown vulnerabilities exists on Hostinger systems. The Hostinger has provided hosting services to 30 million users in 178 countries and territories, and about half of the user information was leaked. For security reasons, the company has now reset the passwords of the affected 14 million users, but other customer information has been leaked and there are no remedies.

According to the official announcement, the leaked database includes the user’s registered mailbox, hash password, user name, real name, home address, and mobile number. The company does not directly use plaintext to store user passwords but uses the SHA-1 algorithm, which is relatively easy for attackers to crack passwords. After the attack, the company has decided to use the SHA-2 algorithm to re-encrypt the user’s password, which is considered to be a remedy in this data breach. In addition, the payment channel is supported by a third party, so the custodian does not save any payment card information of the user, so there is no security issue in the financial aspect.

It is unclear how many users’ information is obtained by an attacker during unauthorized access. The company said it is currently worried that attackers will use stolen information for phishing attacks or fraud, tricking users into making fake website payments. This hoster user has both individual users and a large number of enterprise-level users, so the probability of success is not small when used for phishing attacks or scams.

Finally, the company also mentioned that all user account passwords have been reset and email notifications have been sent, and security companies and local law enforcement agencies have been contacted for investigations.