All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Gcore compromised via ISPsystem panel
JohnFilch123
Member
Got this 30 mins ago:
Updates regarding security
incident affecting personal data
Dear Customer,
Attackers gained access to part of our Hosting infrastructure through a vulnerability in third-party software. We have found no evidence that your data was read or copied, but we cannot rule it out, so we are notifying you now to help you assess the risk and decide whether to inform your supervisory authority or your own customers. We recommend rotating passwords, keys and other secrets stored on your servers.
Gcore acts as your processor or sub-processor for the content on your servers, and you are the controller (or processor). This notice is sent without undue delay under Section 6.1 of our Data Processing Agreement and contains the information required by Art. 33(3) GDPR. If you are a processor, please forward it to the relevant controllers without delay.
What happened
What we know
On 18.10.2026 at 14:44 CEST, we detected unauthorized access to our VMmanager and DCImanager control panels. The attackers exploited a vulnerability in third-party virtualization software and reached the servers (hypervisors) that run customers' virtual machines. This is confirmed in some of our Hosting locations. Other locations show no signs of it.
What we don't know.
We have no evidence that data on your virtual disks was read, copied or sent out, but we cannot exclude it: malicious software on a hypervisor can read a virtual machine's disk without leaving traces. For this reason we treat the incident as a potential personal data breach.
What we have not seen.
We found no modification or deletion of data.
What is not affected.
Gcore account data and other data we process as a controller is not affected. Billing and payment systems and dedicated servers show no signs of compromise, and we have no indication that other Gcore products are affected.
Which data subjects and data are involved.
This depends on what you run on your servers (for example your own customers, employees or end users). We cannot reliably estimate the number of data subjects or records concerned; you are best placed to assess this.
What this could mean for you
If your disks were read, the attacker could have obtained keys, configuration files, access tokens and other secrets, wallets, saved browser data and other files. The possible consequences are disclosure of personal and confidential business data, and a higher risk of phishing, fraud, identity misuse and account takeover for you and your data subjects.
Because we can neither confirm nor exclude that data was read, we recommend assuming the worst case when assessing the risk.
What we have done
▶ Stopped the attack path. We switched off the VMmanager and DCImanager control panels and isolated the affected systems.
▶ Changed access. We changed all keys and passwords to cut off any attacker access.
▶ Removed attacker tools. We shut down all attacker services and software we found.
▶ Blocked data from leaving. Servers are isolated from the internet, so files cannot be sent out from them.
▶ Closed the vulnerability. We installed all patches and, on the vendor’s advice, removed the packages used in the attack. We see no further attacker activity and believe the attackers no longer have access.
▶ Investigating. We are working with the vendor to assess the full scope and impact of the incident. We will notify affected customers if further relevant information is confirmed.
What this means for your service
Existing virtual machines continue to run normally. Until the control panels are back, you cannot create, stop, or manage virtual machines through them. We are restoring them in phases; in some locations, this may take up to a week.
What we ask you to do
▶ Change passwords and SSH keys, as well as API keys, tokens and other secrets stored on or used from the affected VMs. This includes cloud, code repository and CI access, VPN configurations and wallet keys.
▶ Review your access logs for unusual activity.
▶ Enable multi-factor authentication where possible.
▶ Assess whether you must notify a supervisory authority (e.g. within 72 hours of becoming aware under GDPR; you may be considered aware once you receive this notice) or affected individuals under the laws applicable to you.
▶ If applicable, record the incident in your internal breach register.
Contacts
Data Protection Officer: MGSI Sarl, 52a route du vin, L-5495 Wintrange, Luxembourg, [email protected].
For any other questions, please write to [email protected].
We will post further updates on the incident and recovery on the Gcore status page.
Best regards,
Gcore Team
Comments
Fuck
fuck
fuck.
It is now happening weekly, tough times.
Fuck... Did they say which locations are affected by this breach? I have servers with them in multiple locations and didn't receive this mail
Not in the email, sadly. I have not yet checked it but curious to know. My server seems to be intact.
I'm loving this....
Wait till all these EU ID companies, and EU restrictions are completely abused by AI along with all typical user data.
Hopefully gov's pull finger out of bum to allow up full blown quantum encryption everywhere without the responsibility it holds as a provider.
Well, it is the same vulnerability as in FirstVDS case. So it might be safe to assume that most, if not all hosters using billmanager/dcimanager/vmmanager/dnsmanager might have been pwned. But some might not be very public about it.
Similar message from ITLDC, for example.
Yep, I guess some of them will want to keep it silent. Tough times.
yuk, i think i have also something registered there.