South African ISP suffers massive password leak online

[Kevin Lancaster]

South African ISP suffers massive password leak online

The names and passwords of a South African Internet service provider’s customer base have been leaked online.

 

[quovadis]

Are these guys still forcing users to register and log into their portal with no SSL ?

 

[Jings]

If usernames, passwords, email addresses, and full names have been leaked, how can Crystal Web say no personal information was exposed? The hacker now possesses full names and e-mail addresses of 5400 clients.

 

[Sinbad]

All passwords were changed as soon as evidence of the leak became apparent...

The no exposed thing was part of the other breach on the portal, last year.

 

[bwana]

If usernames, passwords, email addresses, and full names have been leaked, how can Crystal Web say no personal information was exposed? The hacker now possesses full names and e-mail addresses of 5400 clients.

That might have been in reference to a previous security breach last year?

 

[faniebraai]

//whats for someone to use my email address to subscribe to pr0nz
//enjoys

 

[Sinbad]

/subscribes fanny to openweb

 

[Bryn]

I got a PM from Hades too. Interestingly, my email address field was blank in that list of customers. Is that why I never received the email containing my new password?

 

[supersunbird]

Standard OpenWeb function...

Second article I've ever read about CW, on MyBB and it has to be bad news...

 

[Jings]

That might have been in reference to a previous security breach last year?

In that case the article is badly written because it gives the impression the leak is current. First paragraph:

The usernames, passwords, email addresses, and full names of Crystal Web’s customers have been leaked online.

The leaked list was posted online by a person who goes by “~hades”, and contained just over 5,400 sets of details of Crystal Web clients.

 

[Sinbad]

I got a PM from Hades too. Interestingly, my email address field was blank in that list of customers. Is that why I never received the email containing my new password?

Interesting. He went to you, to mybb, but not to crystal web themselves?

 

[Sinbad]

In that case the article is badly written because it gives the impression the leak is current. First paragraph:

Well yes, nothing like conflating and compounding bad news

 

[faniebraai]

/subscribes fanny to openweb

who is this fanny, and can i have her contact details as well?

 

[Jings]

Well yes, nothing like conflating and compounding bad news

Hardly a conflation. If my e-mail address and full name was leaked online, I'd be pretty pissed off as a client.

 

[bwana]

In that case the article is badly written because it gives the impression the leak is current. First paragraph:

Not really:

The user base leak follows a DSL username and password breach on Crystal Web’s online portal in November 2015.

No personal information was exposed and the breach was patched, said Crystal Web at the time.

Perhaps they could lose the paragraph break though.

 

[Sinbad]

Hardly a conflation. If my e-mail address and full name was leaked online, I'd be pretty pissed off as a client.

Imagine how the CW staff feel. This was a service provider who was compromised before their company even started...

 

[bwana]

I got a PM from Hades too. Interestingly, my email address field was blank in that list of customers. Is that why I never received the email containing my new password?

How did he know to contact you directly?

 

[Jings]

Not really:

Perhaps they could lose the paragraph break though.

Yeah, they didn't even know the hacker had stolen the information. Scary stuff imo.

 

[Sinbad]

Yeah, they didn't even know the hacker had stolen the information. Scary stuff imo.

Reading is really tough for you?

 

[Bryn]

Interesting. He went to you, to mybb, but not to crystal web themselves?

I'd be surprised if DJ wasn't also PM'd. The hades guy must have regarded that as due diligence with regards to notifying CW.