Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


Shells Virtual Desktop
BMail.ag - Secure Email Service
Server.net
CPLicense.net
VPS Server
Buy VPN
Vultr
VMs for AI
HostDare
HostDare
ReliableSite White-Label Dedicated Hosting for Resellers
InterServer VPS
BMail.ag - Secure Email Service
Best VPN
High-Performance Bare Metal Server Solutions
Karvl.com
Server Mania Cloud Hosting
DataWagon Hosting
AlphaVPS Hosting
Evoxt.com
Clouvider
VPS Hosting with NVMe
Residential IPs in the US & 4G Mobile Proxies in EU & US with Unlimited Bandwidth
ReliableSite White-Label Dedicated Hosting for Resellers
Rabisu - Hosting Solutions
Shells Virtual Desktop
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

What happened to CloudCone? Was it hacked?

15678911»

Comments

  • rpqurpqu Member

    @Fubukibox said:
    Got a message from that dumb "hacker" telegram bot lol

    To CloudCone users
    
    We remembered one thing we forgot to tell you.
    The CloudCone admin password has not changed since 2019 (before we arrived), meaning that for seven years, your data has been exposed and unsafe.
    


    🤡

  • @Fubukibox said:
    Got a message from that dumb "hacker" telegram bot lol

    To CloudCone users
    
    We remembered one thing we forgot to tell you.
    The CloudCone admin password has not changed since 2019 (before we arrived), meaning that for seven years, your data has been exposed and unsafe.
    

    Thank you for that info. This is highly important info because it points to a password as being an issue. If this is true, then the next question is how they got it.

  • Day7:All my vps are back online.

    SLA=76.67%

  • I've got this as well.. a bit concerning, isn't it?

    @Fubukibox said:
    Got a message from that dumb "hacker" telegram bot lol

    To CloudCone users
    
    We remembered one thing we forgot to tell you.
    The CloudCone admin password has not changed since 2019 (before we arrived), meaning that for seven years, your data has been exposed and unsafe.
    
  • Where did you get that message?

  • jmarinarojmarinaro Member
    edited February 6

    @justyy said:
    I've got this as well.. a bit concerning, isn't it?

    @Fubukibox said:
    Got a message from that dumb "hacker" telegram bot lol

    To CloudCone users
    
    We remembered one thing we forgot to tell you.
    The CloudCone admin password has not changed since 2019 (before we arrived), meaning that for seven years, your data has been exposed and unsafe.
    

    Wow... very bad if true. All I know is that Debian is not an option to install, and I cannot even "DESTROY VPS" ... it says "Sorry, VPS related actions are unavailable at this time".

    ...In other words, I am trying to destroy my VPS which automatically cancels any renewals, and so far I cannot. The system is perhaps overloaded? with all the customers trying to perform operations on their VPS's?

  • @jadehsn said:
    Where did you get that message?

    Telegram bot. They sent this to me.

  • Why hasn't my VPS been restored and I still can't reinstall the system?

  • Been similar for me. I tried doing a rebuild, and it would error out. Tried again last night, and it errored but then I got an email that it was being rebuilt. Couldn't connect still though.

  • Welp.

    I feel sorry for them. Cheap sometimes mean they are lame.

  • Rumors claim that CloudCone will compensate customers affected by this incident.

    Source https://www.nodeseek.com/post-613028-1

    But it feels unlikely.

  • @sunkiss said:
    Rumors claim that CloudCone will compensate customers affected by this incident.

    Source https://www.nodeseek.com/post-613028-1

    But it feels unlikely.

    Their customers have been down for like two weeks with almost zero communication. Feels like deadpool is more likely than compensating customers.

  • They sent out a notice this morning. They are giving two free months.

  • JordJord Moderator, Host Rep, Megathread Squad
    edited February 10

    Didn't they use onapp to begin with? I guess they switched to Virtualizor after it was sold. But my very old VM is still working. So I guess I'm on their old onapp setup. If I'm remembering correctly.

  • CloudconeCloudcone Member, Patron Provider
    edited February 11

    @Jord said:
    Didn't they use onapp to begin with? I guess they switched to Virtualizor after it was sold. But my very old VM is still working. So I guess I'm on their old onapp setup. If I'm remembering correctly.

    We still do use OnApp for our SC2 hourly billed VMs to date. This incident only affected our VPSs (budget tier offering) in Los Angeles DC (which uses Virtualizor)

    A detail of all emails sent is available here: https://app.cloudcone.com/incident-346624

  • CloudconeCloudcone Member, Patron Provider
    edited February 12

    Hello Everyone

    We wanted to publish a transparent public update here regarding the recent incident that affected a portion of our Los Angeles Budget VPS infrastructure. Many of you asked for a clear explanation, so this comment provides a straightforward breakdown.

    For anyone who wants to read the full official statement from our website, you can find it here: https://app.cloudcone.com/incident-346624

    During the early hours of Friday, January 30, 2026, our monitoring systems detected that several virtual machines had lost network connectivity. We immediately isolated the affected nodes to prevent further spread, and a full technical and forensic investigation was launched.

    From the earliest moments, the team prioritized transparency. Real-time updates were posted on the Official Status Page so customers could follow developments as they happened and stay informed throughout the recovery process.

    Scope of Impact

    The incident was limited in scope but significant for those affected:

    • Only a portion of the Budget VPS line located in Los Angeles, USA was impacted.
    • Affected VPS data was determined to be in an irrecoverable state.
    • Impacted Budget VPS instances remained offline until customers completed reinstallations.

    Importantly, no other CloudCone services, products, or datacenter locations were affected. Customer personal information remained secure because personal data, billing records, and payment details are not stored on this third-party platform.

    Immediate Response and Security Actions

    As soon as the issue was identified, our engineering teams implemented several immediate measures to stabilize the platform and strengthen security:

    • Clean reinstallation of the VPS deployment gateway and affected host nodes.
    • Rotation of all API keys and sensitive credentials.
    • Additional hardening of IP-level access controls and firewall rules.

    Throughout the weekend of January 31 to February 1, DevOps Engineers and Support staff worked continuously. Thousands of support requests were handled while teams rebuilt systems and optimized infrastructure to manage the surge in demand. Long days and late nights were spent with one clear goal: restoring services safely while reinforcing the platform.

    Recovery Efforts and Customer Support

    As the new week began on Monday 2nd of February, CloudCone's systems experienced a large wave of VPS rebuild requests. Teams focused on scaling and optimizing the reinstall process to help customers get back online as quickly as possible. On the support side, the majority of affected customers received quick assistance in restoring any backups they had and resuming normal operations.

    Internally, teams held multiple daily coordination meetings to stabilize operations and accelerate recovery efforts. The focus extended beyond short-term fixes; our goal was to rebuild trust through meaningful actions and long-term improvements.

    Compensation Measures

    As part of our commitment to supporting customers after the incident, we introduced these measures:

    Credit Compensation Based on Customer Feedback: All impacted customers automatically received account credits equivalent to one full month of their VPS package. For example, a VPS billed at $60 per year would receive $5 in account credits added directly to the account balance.

    Service Extensions: Affected servers will automatically receive a free two-month service extension at each of the next two renewals, for a total of 4 free months of service. For example, a standard 12-month annual renewal will be extended to 14 months at no additional cost. Updated due dates will be applied automatically as renewals occur.

    Discounted Monthly Backups: In Q2 2026, affected customers will receive 50% off monthly server backups for up to one year on the upcoming platform. This initiative aims to strengthen long-term data protection and provide additional peace of mind.

    Platform Improvements and Migration

    All Budget VPS instances are scheduled to be migrated to CloudCone’s new in-house platform, which was already in final testing prior to the incident and is expected to launch by the end of March. The new platform is designed to deliver improved reliability, performance, and enhanced security.

    We understand that no form of compensation can fully offset the disruption experienced. However, we emphasized that these actions represent a sincere effort to support customers and improve the overall experience moving forward.

    Moving Forward

    This external attack tested the resilience of both our infrastructure and our team. Despite the challenges, we reaffirmed our commitment to transparency, reliability, and continuous improvement.

    We sincerely apologize to everyone affected and are grateful for the patience, understanding, and collaboration shown by the CloudCone Community 💚 throughout the recovery process. Many customers worked alongside the team to help rebuild services, and that partnership remains a core part of moving forward together.

    As rebuilding continues and the new platform approaches launch, our focus remains clear: learning from the incident, strengthening our systems, and earning back customer trust through real actions, not just words.

    We truly value every one of you.

    Thanked by 2oloke rpqu
  • @Cloudcone said: Affected VPS data was determined to be in an irrecoverable state.

    Actually, only the first and last 512 MiB were destroyed. A lot of data could be recovered using photorec.

  • forestforest Member
    edited February 13

    You can test this yourself to prove that quite a lot of data really is recoverable:

    # create filesystem and populate it with example files
    fallocate -l 10G testfs
    mke2fs -t ext4 -d /usr/share testfs
    
    # damage filesystem in the manner of the "ransomware" script
    dd if=/dev/urandom of=testfs bs=1M count=512 conv=notrunc
    dd if=/dev/urandom of=testfs bs=1M count=512 conv=notrunc oseek=9728
    
    # attempt to recover data
    photorec testfs
    

    Please give customers the option to recover the data themselves rather than writing it off just because you don't know how to automate it. Btw, if you do need help automating it, I would be happy to assist.

    Thanked by 3rpqu ayerfton zed
  • Good reminder to always backup the important stuff on your servers. I personally use Restic and never leave anything not reliably backed up. Something like this might happen or hell they might just suddenly suspend your account and delete your data for whatever reason.

  • rpqurpqu Member

    @Monocle said:
    Good reminder to always backup the important stuff on your servers. I personally use Restic and never leave anything not reliably backed up. Something like this might happen or hell they might just suddenly suspend your account and delete your data for whatever reason.

    I would advocate for having a offline copy under your direct control e.g your closet, safe (or SDB) beside the usual 3-2-1.

    Thanked by 1Monocle
  • Wrote a little post about server backups if anyone is interested

    https://lowendtalk.com/discussion/214588/always-backup-your-server-vps-never-trust-one-provider/

    Thanked by 1Cloudcone
  • CloudconeCloudcone Member, Patron Provider

    Thank guys, for sharing your perspective and for recognizing our transparency on this issue. We also understand that standalone servers from any provider claiming high reliability don’t always give the peace of mind you need, especially when running critical workloads.

    That’s why we offer our SC2 (Scalable Cloud Compute) line with Automated Backups, as well as Dedicated Servers with RAID Controllers for users who need extra control and security for sensitive data.

    At the end of the day, absolute resilience comes from combining the right infrastructure with solid backup practices, and we’re focused on giving our users flexible options that protect what matters most.

    Feel free to explore our ongoing SC2 Sale; we are offering Free Auto Backups & Snapshots to the first 100 users to deploy.

    Thanked by 1default
Sign In or Register to comment.