Hostwinds, a HostPapa company

System Status

Security incident: client area back online, action needed

Status:
Monitoring
Posted:

Update: As of , PayPal payments are working again. If a PayPal payment failed for you, please try again.

The Hostwinds client area is back online at clients.hostwinds.com. It reopened on the evening of October 23 on a newly built system. As part of our response to the recent security incident, we've reset every client area password, so your old password no longer works. We've also emailed our customers with full details and the steps to take. Our investigation with an independent forensic firm is continuing.

What you should do now: Please follow these steps in order.

  1. Set a new client area password. Type clients.hostwinds.com into your browser and select “Forgot password.” Use a password you don't use anywhere else, and turn on two-factor authentication (2FA). Don't use links in emails to do this. Under User Management, remove any users you don't recognize.
  2. Secure your services. Change root and administrator passwords, SSH keys and control panel passwords directly on your server, not through the client area, then back up your data. Leave the Hostwinds security key described in our email in place.
  3. Check for anything unusual, such as user accounts, keys, DNS records or account details you didn't change, and change any password you've shared with us in a support ticket.

Step-by-step instructions are at https://www.hostwinds.com/product-docs/support/. If you find signs of access, contact support@hostwinds.com.

Service status: Customer servers and websites remain online. If you can't sign in yet, email support@hostwinds.com.

Still affected: PayPal payments are temporarily unavailable while we reconnect them. The affiliate portal (affiliates.hostwinds.com) remains offline; we will post an update here for affiliates.

Watch for suspicious messages: You'll only get a password reset email after you select “Forgot password” yourself. We'll never ask for your password, SSH keys or full card number by email, chat or phone. If a message about this incident looks wrong, don't click its links: type status.hostwinds.com into your browser instead.

Email Support

Security incident: PayPal payments restored

Status:
Resolved
Posted:

Since our last update, PayPal payments are working again. If a PayPal payment failed for you, please try again. Access to the Hostwinds client area at clients.hostwinds.com remains restored.

If you haven't already, please take these steps:

  1. Set a new client area password. Type clients.hostwinds.com into your browser and select “Forgot password.” Use a password you don't use anywhere else, and turn on two-factor authentication (2FA).
  2. Keep a current backup of your data outside your Hostwinds server.
  3. If you manage your own server, change the root and administrator passwords, replace your SSH keys, and remove any users or keys you don't recognize. Leave the Hostwinds security key described in our email in place.
  4. Check for anything unusual, such as user accounts, keys, DNS records or account details you didn't change, and change any password you've shared with us in a support ticket.

If you find signs of access, contact support@hostwinds.com.

Our investigation with an independent forensic firm is continuing, and we will post further updates here.

Watch for suspicious messages: You'll only get a password reset email after you select “Forgot password” yourself. We'll never ask for your password, SSH keys or full card number by email, chat or phone. If a message about this incident looks wrong, don't click its links: type status.hostwinds.com into your browser instead.

Email Support

Security incident: Hostwinds client area offline

Status:
Resolved
Posted:

Update: The Hostwinds client area reopened on the evening of October 23 at clients.hostwinds.com. See the “client area back online” update above for the steps to take.

Overview: We recently identified unauthorized access to the system that runs the Hostwinds client area and billing. We proactively took the client area offline as a precaution and have been working on maintaining service while we're investigating. We are working with an independent forensic and cybersecurity firm and the appropriate law enforcement agencies have been notified.

Service status: Customer servers and websites remain online. As a precaution, we have disabled access to potentially impacted services while we continue to investigate. Because of this, you may not be able to sign in to your server for now, and the client area remains offline. We're working to restore your access. If you need access to your server before then, email our team at support@hostwinds.com. We appreciate your patience.

What you should do now: As a precaution we advise you to keep a current backup outside your Hostwinds server; if you manage your own server, change root and administrator passwords and replace SSH keys directly on the server; check for users or keys you don't recognize; and change any password you've shared with us in a support ticket.

Watch for fake messages: Our incident emails come from support@hostwinds.com but sender addresses can be faked, so we'll never ask for your password, SSH keys or full card number by email, chat or phone.

Further updates: We will provide further updates as more information becomes available.

Email Support