Web.com has announced that it as well as Register.com and Network Solutions all suffered a data breach in August.
A disclosure notice that was published across all three sites, revealed that on October 16, the company had “determined that a third-party gained unauthorized access to a limited number of our computer systems in late August 2019, and as a result, account information may have been accessed”.
According to Web.com, contact details including user's names, addresses, phone numbers, email addresses and which web hosting products they had purchased were all acquired by hackers as a result of the data breach.
- Data breaches hitting more companies than ever
- These are the world's most popular web domains
- CISOs believe data breach experience makes them more employable
While customer passwords have been reset as an added precautionary measure, a spokesperson for Web.com explained to Brian Krebs that it encrypts all user passwords and that the company believes no passwords were obtained by the attackers, saying:
“We encrypt account passwords and do not believe this information is vulnerable as a specific result of this incident. As an added precautionary measure, customers will be required to reset passwords the next time they log in to their accounts. As with any online service or platform, it is also good security practice to change passwords often and use a unique password for each service.”
Data breach
Thankfully no credit card data was compromised during the incident which Web.com has already reported to federal authorities.
The web host confirmed in its disclosure notice that all of its customers' credit card numbers are stored in a Payment Card Industry (PCI) compliant encryption standard and that there was no sign that the attackers were able to access users' credit card information. However, Web.com is encouraging customers to monitor their credit card accounts and notify their providers if they do find any suspicious charges.
Security awareness advocate at KnowBe4, Javvad Malik warned that the attackers behind the Web.com data breach may try to use the customer information they acquired to launch phishing attacks, saying:
“Without more details on the incident, it is difficult to establish the objectives of the attackers. It could be possible that this was an opportunistic attack to steal credentials or personal information. It's important for companies of all sizes and verticals to invest in security, especially where customer data is involved, not just payment information.
"Customers who are affected should change their passwords, and also check their accounts to ensure no changes have been made to any of their details or sites. They should also be extra vigilant against any potential phishing emails that criminals may send using the information stolen from these breaches.”
- Also check out the best domain name registrars of 2019
Via Forbes
