Communication Breakdown
Communications from the world of, er, communications. And other stuff.
Thursday 18 October 2007, 2:49 PM
Major breach at Fasthosts
Over to the victim:
As the breach could relate to Fasthosts customer data, in line with our established practice of protecting the interests and privacy of our customers, Fasthosts has subsequently reviewed and updated its security and worked with external security experts to ensure that all data held by Fasthosts is secure.
As a precautionary measure, Fasthosts has asked its customers to update their passwords. This includes their control panel, email, FTP, and database passwords, all of which can be changed via the customer control panel. Fasthosts has now implemented customer password encryption to further protect customer data.
Fasthosts has established procedures for dealing with any issues that could impact its customers, including promptly notifying all relevant authorities. A system-wide external security audit has removed the vulnerability that led to the recent network intrusion and enhanced the overall security appropriately. Fasthosts considers that its practices and procedures are up to date, and represent good practice in continually protecting the security of its customer data, and the company remains fully confident in its ability to do so.
Fasthosts apologises for any concern or inconvenience caused to its customers as a result of the security review.
As well it should!
PreviousComments on this post
"A system-wide external security audit has removed the vulnerability that led to the recent network intrusion"
I realise they can't list the exact vulnerability but I can't help being curious as to the origin of the software.
Homegrown or 3rd party?
For the small user considering a hosting company the most frequent questions are along the lines of :
How much space will I have ?
Bandwidth Allowance?
Number of Email addresses?
Less likely questions consist of:
What is your monthly patching cycle like? And will zero-day fixes have a fast-path to live?
Can I test these patches against my live content before implementation?
And they've been hacked again and have changed EVERY customer's passwords arbitrarily and without warning. Then posting the new ones out. A complete shambles. Read the Comments on The Register!
We're moving. Not subjecting ourselves to this nonsense again.
Or, you could even check out the story on this site - it went up on Friday.
