Web hosting company “No Support Linux Hosting” (NSLH) announced on February 9 that it is shutting down after a hack in which a cybercriminal broke into its internal systems and compromised its entire business. According to a message posted on its official website, the company said it was breached on Monday, February 8. The hacker appears to have compromised the company’s entire business, including its official website, admin area, and database .
A spokesperson for No Support Linux Hosting declined to provide further information about the hack. Although the reasons for the cyberattack remain unknown, it is expected to have devastating consequences.
Specifically, the web hosting company stated the following: “We are no longer able to operate the No Support Linux Hosting business. All customers should immediately download backups of their sites and databases via cPanel before the servers are permanently taken down.”
It is not yet clear whether the hacker downloaded and "emptied" the company's databases and backups or whether this is a classic ransomware attack in which the attacker encrypted files and demanded a ransom from the victim to provide a decryption key.
TorrentFreak ,a site that covers digital rights and hacking news, reported that two other UK-based web hosting companies that provide IPTV services to pirated streaming sites have suffered similar hacks. Specifically, SapphireSecure.net and KS-Hosting.com posted a message from the alleged hacker on their homepage on February 8.
In the message, the hacker mentions the personal details of the person behind the two sites and threatened the two companies that he would share their customer databases with the police and copyright protection agencies if they refused to pay a ransom of 2 BTC ($92,000).
As ZDNet reports, the security incidents at these two companies may be linked to the hack suffered by No Support Linux Hosting. This conclusion stems from the fact that the hackers who “hit” SapphireSecure.net and KS-Hosting.com also gave the companies the option of either “closing down for good” to avoid sharing their data with authorities, or paying the required ransom.
Therefore, it is estimated that behind all the aforementioned attacks it is very likely that the same malicious actor is hiding.
