Hetzner South Africa acknowledged on 1 November that their customer database was compromised. We have received inquiries from clients with concerns that their services may be at risk.
What is Anno Internet’s relationship with Hetzner?
We host our South African server infrastructure with Hetzner in their Cape Town data centre.
What was hacked?
You can read Hetzner’s statement at https://hetzner.co.za/news/konsoleh-database-compromise/. The punchline is:
- Hackers gained access to Hetzner’s customer database through a flaw in their KonsoleH control panel. Customer contact information and login information were exposed to the attackers.
- Direct clients of Hetzner should be very concerned and should change their passwords. (We updated our own customer passwords with Hetzner immediately.)
- Logins and personal information of Anno clients are not involved.
It is worth noting that Hetzner has been very forthcoming and very professional in their handling of the incident. They are a quality company,
Was logins to Anno server leaked?
Passwords for remote access console (a network-based login we use for maintenance or emergency access) were exposed to the hackers. This information is not sufficient for someone to gain access to data on any of our servers; they would also need to know the root user passwords. Hetzner does not have any knowledge of our root user passwords and such information is not stored in their customer database. We can therefore say with 100% confidence that data on our servers was not accessible by the attackers at any time.
Do you need to take any action?
Unless you are a direct customer of Hetzner, then no action is needed. But this is still good reminder to use unique password everywhere you go.