Sunday August 25, 2019
4 min Read
Sunday August 25, 2019
4 min Read
We want to update you on what further steps are being taken to ensure the future security of Hostinger’s clients and services, along with what our teams have learned while revising the security vulnerability issues that caused the incident. This is just the beginning of our security improvement roadmap. Here is what we have done so far:
As you can see, some efforts are still ongoing since we are prioritizing sustainable and smooth implementation. We aim to finalize these changes before the start of 2020 while planning other security improvements for the future. We will make sure that all Hostinger web hosting clients will be informed on the latest changes on our blog so they can begin using these new features as soon as possible.
Finally, we would like to thank our entire community for the utmost patience, trust, help, and feedback provided during the incident. We would not be where we are now without all of you.
We have reset all Hostinger Client passwords as a precautionary measure following a recent security incident. We are taking this extremely seriously and want to let everyone know what has happened and the immediate steps we have taken to protect our clients’ security.
During this incident, an unauthorized third party gained access to our internal system APIs. One of them had access to hashed passwords and other non-financial data about our customers.
We have restricted the vulnerable system, and such access is no longer available.
We are also in contact with the respective authorities.
On August 23rd, 2019 we received informational alerts that one of our servers had been accessed by an unauthorized third party. This server contained an authorization token, which was used to obtain further access and escalate privileges to our system RESTful API Server*. This API Server* is used to query the details about our clients and their accounts.
*[Latest Edit on 2019-08-25 17:43 UTC]
The API database, which includes our client usernames, emails, hashed passwords, first names, and IP addresses was accessed by an unauthorized third party. The respective database table that holds client data, has information about 14 million Hostinger users.
We use a cryptographic hash function to encrypt all our client passwords. It is a one-way mathematical function that converts your password to a seemingly random sequence of characters. However, as per standard and precautionary security practices, we have reset all Hostinger client login passwords. We have sent emails to all Hostinger clients with further information regarding the password reset.
Payments for Hostinger services are made through authorized and certified third-party payment providers. It means that we never store any payment card or other sensitive financial data on our servers and it has not been accessed or compromised.
We completed a thorough internal investigation. Hostinger client accounts and data stored on them (websites, domains, hosted emails, etc.) remained untouched and unaffected.
Following the incident, we have identified the origin of the unauthorized access and have taken necessary measures to protect data about our clients. This includes a mandatory password reset for our clients and systems within all of our infrastructure.
Furthermore, we have assembled a team of internal and external forensics experts and data scientists to investigate the origin of the incident and increase the security measures of all Hostinger operations. As required by law, we are already in contact with the authorities.
The investigation is still in its early stages. All updates regarding this security incident will be posted in this blog, on our status page, and sent directly to our clients via email and across other channels.
Following the password reset, we urge our clients to choose strong passwords that are not utilized elsewhere. Clients should be cautious of any unsolicited communications that ask for your login details, personal information, or refer you to a website asking for the above information. We also strongly suggest not clicking on the links or downloading attachments from suspicious emails.
We remind our clients not to use the same passwords on multiple service providers across the web and to generate strong unique passwords with password management tools.
If you have further questions regarding the security of your account, you may contact the Hostinger Help Center which is available 24/7.
We will be updating this blogpost regularly with important updates regarding this security incident.
If you have any further questions, please refer to Hostinger Help Center.
For media inquiries, please contact email@example.com.
If you wish to delete your personal data from Hostinger, please contact firstname.lastname@example.org.