Hacker breaks into ThrustVPS, launches phishing attack from firm's own servers

Virtual private server firm ThrustVPS has taken the unusual step of admitting it had suffered a phishing attack.

Rather than taking the time-honoured solution of just pretending nothing had happened and correcting the issue on the sly, the VPS provider sent an email to customers 'fessing up to the attack.

"The phishing attack came from our server," the admin team wrote in an email to customers. "Upon further investigation the attacker had managed to gain access to the whmcs installation and upload his own files, namely a php shell and a mailer script. These have now been removed and the server has been secured.

We are also looking to introduction [sic] extra security to make sure we have no further repeat of issues you have experienced over the weekend.

As a precaution, customers were asked to login and update their passwords. They were reassured that ThrustVPS does not store any credit card information on its systems, so there was no chance of any financial disasters.

"Our apologies for any inconvenience this has caused and please let us know if there is anything we can assist with during this time," the email continued.

The first mention of the problem came on Twitter, before a post was uploaded to Reddit warning of a "honeypot".

On Twitter, one user questioned whether Thrust's customer database had been compromised.

@thrustvps What I meant was, do you think the attackers had enough time to download a copy of the database?

— Gareth C (@gdude2002) January 20, 2014

Others had a predictable grumble:

Looks like @thrustvps have done a runner. Hacked, offline, no communication in 24hrs of downtime. No real business would operate like this.

— Luke Bennett (@developerluke) January 20, 2014

Others, however, praised them:

Big hand to @thrustvps for noticing a compromise and quickly telling customers and resolving. Great team!!

— Dan Bennett (@DanBennett) January 20, 2014

The firm, which has an outpost in Maidenhead, tweeted yesterday that all was now well within its walls. ®