Hacked Hostinger’s Database Exposed Some 14 Million Customers Data

Web hosting provider Hostinger had its customer database hacked, forcing it to reset all of its clients' passwords as a “precautionary measure”.

Founded in 2004, Hostinger has more than 29 million users across 178 countries. And this database breach exposed some 14 million of its customers' data.

“During this incident, an unauthorized third party has gained access to our internal system API, one of which had access to hashed passwords and other non-financial data about our customers,” wrote the Lithuania-based company.

The company first discovered this incident in August 23rd, when it was alerted about the breach on one of its servers.

What happened here was an authorization token found in the server granted access to systems without the need for any username and password.

Hostinger - hacked
"The API database, which includes our Client usernames, emails, hashed passwords, first names and IP addresses have been accessed by an unauthorized third party. The respective database table that holds client data, has information about 14 million Hostinger users."

After breaching the system, the hacker managed to gain deeper access through leveraged privilege.

This allowed the hacker to take control of Hostinger's API server which is used to query client details and their account information, including Hostinger customers' usernames, first names, email addresses, phone numbers, home addresses, IP addresses, and hashed passwords.

Fortunately, customers' data about their sites, domains and hosted emails weren't affected.

Financial data was also kept intact, because Hostinger isn't storing any credit card information, as payments are all handled through the company's authorized and certified third-party providers.

[block:block=87]

Following the hack, Hostinger immediately removed the access, and "secured the API and all related systems".

As the company is looking for the cause of the breach and its actors, the company also alerted the authorities to aid them in the situation.

"We are continuing our internal review, implementing new security procedures and hardening server and network settings," said the company on August 25th, saying that all affected customers should have already received a password reset email.

"We urge our Clients to choose strong passwords that are not utilized on other websites. Clients should be cautious of any unsolicited communications that may ask for your login details, personal information or refer you to a website asking for the above-mentioned information. We also strongly suggest to avoid clicking on the links or downloading attachments from suspicious emails."

"We remind our Clients not to use the same passwords on multiple service providers across the web and to generate strong unique passwords with password management tools."