000WebHost Hacked – 13.5 Million Email And Passwords Up For Sale After Attack On Free Website Hosting Service

Free website hosting provider 000WebHost was hacked. Its database, which includes 13.5 million email addresses, passwords, and other sensitive user information, was made available on the Darkweb.

000WebHost, a popular website hosting provider, suffered a rather large security breach. Though the service provider has been taking precautionary steps to fix the security breach, sensitive information of more than 13.5 million accounts was accessed and now lies in the possession of an enterprising third party who wishes to profit from it.

000WebHost is a Lithuanian hosting space provider, and the hack was first uncovered by independent security researcher Troy Hunt, who’s best known for running a dependable service called Have I been Pwned?, which searches across multiple data breaches to check if your email addresses has been compromised.

Hunt not only discovered the data breach, but he has managed to cross-verify the hack is real by contacting five of the people included in the list of email accounts. Incidentally, he claims he was contacted by an anonymous source who claimed to have a database containing the credentials of 13.5 million 000Webhost users and may have offered a few names of the victims to allow any potential buyer to verify the information was legitimate.

Elaborating about the hack, Hunt wrote in a blog post on his website, “By now there’s no remaining doubt that the breach is legitimate and that impacted users will have to know.”

Considering the number of user accounts compromised, the data breach is a huge one. What’s even more concerning is the fact that those who managed to lay their hands on the database have managed to get real names, usernames, email addresses, passwords, and IP addresses as well. But what trumps all, Hunt explained, is the fact that the record dumps contained plain text passwords. In simple words, the hackers needed only to grab the database, which contained the passwords in unencoded format.

Needless to say, it is imperative for users of 000WebHost to change their passwords. Moreover, many users have the habit of using the same password across many services. As such, users should change their passwords on other services as well.

What’s even more bizarre is that 000WebHost appeared to downplay the incident and even refused to publicly admit that it had been hacked, reported Silicon Angle. As a precautionary measure, it forced its users to enter new passwords by resetting their login credentials. However, since the news of the hack has spread like wildfire, the service provider was forced to acknowledge the fact:

https://www.facebook.com/000webhost.Global/posts/998261600194776

000webhost is a free web hosting service which supports both PHP and MySQL, the two most popular databases. Owing to the simplicity and the zero cost to host a basic website, 000WebHost caters to millions of users worldwide.

How did the hackers gain access to 000WebHost’s database? Breaches like this happen quite regularly. As evident by the recent data breach suffered by dating website Ashley Madison, skilled programmers with malicious intent are always looking for vulnerabilities and weak points in the security of a platform to exploit.

Apparently, the hackers may have used an old exploit in an old, unpatched version of PHP to upload malicious files and gain access to the service’s systems, reported ZDNet. The hackers not only managed to capture the complete database but are looking to profit from it as well. Though it is unclear who is behind the attack, the information has been made available on the Darkweb, a digital marketplace for people looking to buy such information.

Though 000WebHost claims to be fortifying itself against future hacks, it has been accused in the past of ignoring repeated warnings from credible sources, reported Beta News. As a result, over 13.5 million account holders are now advised to be extra cautious.

[Photo by Gregor Schuster / Getty Images]