ColoCrossing colocrossing.com ColoCrossing data breach: what happened and what to do
In May 2025, hosting provider ColoCrossing identified a breach of its ColoCloud virtual server platform. About 7,000 email addresses leaked with names and MD5-Crypt password hashes.
View all 13,177 breaches- Breach date
- 24 May 2025
- Affected
- 7,183
- Data exposed
- Email addresses, Names, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
In May 2025, hosting provider ColoCrossing identified a data breach that affected customers of its ColoCloud virtual server product. According to Have I Been Pwned, ColoCrossing said the incident was isolated to its cloud and VPS platform and came from a single sign-on vulnerability.
Sources checked: haveibeenpwned.com, lowendbox.com, consumer.ftc.gov
Last verified against the official page:
What was exposed
The breach exposed 7,183 email addresses, along with names and password hashes in the MD5-Crypt format. A hash is a scrambled version of a password, and MD5-Crypt is an older format that is easier to crack than modern ones.
What that means for you
Server customers are worth targeting: a cracked password can open a control panel or a server. Reuse is the main risk, since attackers try leaked passwords on other hosting accounts and services. Names and emails also support phishing that poses as your hosting provider.
What to do
Change your ColoCloud password and every account that shares it, turn on two-factor login on your hosting and control panel accounts, and check your servers for logins or changes you don't recognize.
What to do if you were in it
- 1
Change your password, and anywhere you reused it
Change your ColoCloud password, and the password on any other account that uses the same or a similar one. Use a password manager so each account gets a unique one.
- 2
Turn on two-factor login
Use an authenticator app or passkey where a site offers it. It blocks most account takeovers even if a password is already out there.
- 3
Review your servers
Check your ColoCloud servers and any SSH keys or API tokens for activity you don't recognize, and rotate credentials if anything looks off.
- 4
Expect phishing that mentions the breach
Your name and email leaked, so messages posing as your host are likely. Don't click links or call numbers in unexpected messages. Go to the company's site yourself, and report scam messages at reportfraud.ftc.gov.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your email or phone number. Serus also alerts you when your details show up in a new one.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the ColoCrossing breach?
If you were a ColoCloud customer, possibly. Search your email on Have I Been Pwned or run a free Serus scan.
What was exposed?
Email addresses, names and MD5-Crypt password hashes.
How did the breach happen?
Have I Been Pwned says ColoCrossing attributed it to a single sign-on vulnerability on its cloud and VPS platform.
Should I change my password?
Yes. Change it on ColoCloud and on anything else that uses the same or a similar password.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
