Russian Hosting Provider Breach Exposes Customer Credentials and Sensitive Data

A significant data breach at FirstVDS, a major Russian hosting provider, has resulted in the unauthorized exfiltration of customer passwords, access credentials, and configuration files. The attackers exploited a vulnerability in the VMmanager 6 virtualization platform to gain read-only access to customer virtual server disks.

This method allowed the exfiltration of sensitive data, including cryptocurrency wallets, without triggering operational disruptions or leaving standard forensic traces on the affected virtual machines. The breach impacts infrastructure across multiple jurisdictions, including Russia, the Netherlands, and Kazakhstan.

FirstVDS has restricted access to the management interface and issued security warnings to affected clients. However, the software vendor has not yet fully remediated the underlying vulnerability, and the scope of the compromise remains undisclosed.

Institutional clients utilizing this infrastructure face elevated risks of secondary attacks, including unauthorized account access and credential stuffing. Security teams are advised to rotate all credentials associated with hosted services and monitor for anomalous activity until full system integrity is verified.