The Italian web hosting company Aruba admitted that it recently fell victim to a data breach after its customers complained online that it had waited too long to notify them regarding the situation.
As reported by The Daily Swig, the company informed its customers in a message sent out last week that it had fallen victim to a data breach back in mid-April which exposed their personal data including full names, tax codes, physical addresses, telephone numbers, emails and encrypted hashes of customer portal passwords.
At that time, Aruba reset customer passwords though it waited around ten weeks until after its investigation into the matter was complete to send out a data breach notification to those affected.
Better late than never
In a statement to The Daily Swig, an Aruba spokesperson explained that its cybersecurity detection systems discovered anomalous activity that was found to be unauthorized access back in April.
The company’s incident response team then blocked the intruder’s access to its systems while it investigated further. As a result of the investigation, Aruba learned that a vulnerability in a third-party CMS was exploited by the attacker to gain access. From here the company informed the authorities and the Personal Data Protection Authority.
During the last two months, Aruba has been working closely with the authorities and cybersecurity experts “to investigate the depth and potential repercussions of the attempted access to or misuse” of its data. Following the completion of its investigation, the company notified customers that a breach had occurred while providing advice and support.
Some of Aruba’s customers though took issue with the fact that the company waited as long as it did to inform them of the data breach. To Aruba’s credit though, it did reset customer passwords immediately after discovering the breach.
At this time, we still don’t know how many customers were affected and Aruba has said that the attackers responsible have not yet reached out to the company.
Via The Daily Swig
