FirstVDS Breach Exposes Customer Data via VMmanager Vulnerability
Russian hosting provider FirstVDS confirmed over the weekend that hackers exploited a vulnerability in VMmanager 6 a virtualization management platform by ISPsystem to steal sensitive customer data. The attack, detected on Saturday, targeted part of FirstVDS’s infrastructure, allowing unauthorized access to virtual servers without disrupting operations.
The attackers deployed malware that copied passwords, cloud service credentials, configuration files, cryptocurrency wallets, and other data from affected servers, transferring it to a server under their control. FirstVDS noted that the breach did not directly compromise virtual machines; instead, the malware mounted disks in read-only mode, leaving no traces of intrusion while exfiltrating data.
FirstVDS, a long-standing provider since 2002, serves customers with virtual private servers (VPS) for websites, applications, and databases, including servers hosted in the Netherlands and Kazakhstan. The company did not disclose the number of affected customers or servers but warned those notified to assume their data was stolen and to reset credentials.
In response, FirstVDS disabled external access to the vulnerable management system and blocked communication with the attackers’ server. ISPsystem released patches, including an update on Monday, though the vulnerability remains partially unresolved. The vendor advised against re-enabling the management interface until further security fixes are deployed.
As of Monday, FirstVDS continued operating with restrictions, including limited VMmanager functionality. Details on the initial exploitation method, affected software versions, and potential misuse of stolen data remain undisclosed. The identity and motives of the attackers are unknown.
Source: https://therecord.media/russia-cyberattack-firstvds-cloud
FirstVDS cybersecurity rating report: https://www.rankiteo.com/company/firstvds
"id": "FIR1792412825",
"linkid": "firstvds",
"type": "Breach",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Web Hosting, Cloud Services',
'location': 'Russia',
'name': 'FirstVDS',
'type': 'Hosting Provider'}],
'attack_vector': 'Exploitation of vulnerability in VMmanager 6',
'customer_advisories': 'Affected customers notified to reset credentials and '
'assume data was stolen',
'data_breach': {'data_encryption': 'No (disks mounted in read-only mode, no '
'encryption mentioned)',
'data_exfiltration': 'Yes (data transferred to '
'attacker-controlled server)',
'personally_identifiable_information': 'Likely (credentials '
'and sensitive data)',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Passwords',
'Cloud service credentials',
'Configuration files',
'Cryptocurrency wallets',
'Other sensitive data']},
'date_detected': '2023-11-11',
'date_publicly_disclosed': '2023-11-12',
'description': 'Russian hosting provider FirstVDS confirmed that hackers '
'exploited a vulnerability in VMmanager 6, a virtualization '
'management platform by ISPsystem, to steal sensitive customer '
'data. The attack targeted part of FirstVDS’s infrastructure, '
'allowing unauthorized access to virtual servers without '
'disrupting operations. The attackers deployed malware that '
'copied passwords, cloud service credentials, configuration '
'files, cryptocurrency wallets, and other data from affected '
'servers, transferring it to a server under their control.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'data breach',
'data_compromised': 'Passwords, cloud service credentials, '
'configuration files, cryptocurrency wallets, '
'and other sensitive data',
'identity_theft_risk': 'High (due to exposure of sensitive '
'credentials)',
'operational_impact': 'Limited VMmanager functionality, restricted '
'operations',
'systems_affected': 'Virtual servers managed via VMmanager 6'},
'initial_access_broker': {'entry_point': 'VMmanager 6 vulnerability'},
'investigation_status': 'Ongoing',
'post_incident_analysis': {'corrective_actions': 'Patching, disabling '
'vulnerable interfaces, '
'blocking attacker '
'communication',
'root_causes': 'Exploitation of unpatched '
'vulnerability in VMmanager 6'},
'recommendations': 'Reset credentials, apply security patches, avoid '
're-enabling vulnerable interfaces until fully resolved',
'references': [{'date_accessed': '2023-11-12',
'source': 'Cyber Incident Report'}],
'response': {'communication_strategy': 'Notified affected customers to reset '
'credentials',
'containment_measures': 'Disabled external access to the '
'vulnerable management system, blocked '
'communication with attackers’ server',
'recovery_measures': 'Continued operations with restrictions, '
'limited VMmanager functionality',
'remediation_measures': 'Applied patches from ISPsystem, advised '
'against re-enabling management '
'interface until further fixes'},
'title': 'FirstVDS Breach Exposes Customer Data via VMmanager Vulnerability',
'type': 'Data Breach',
'vulnerability_exploited': 'VMmanager 6 vulnerability'}