Staminus staminus.net Staminus data breach: what happened and what to do
Hackers broke into DDoS protection firm Staminus in March 2016, knocked its network offline for over 20 hours and leaked customer data online. About 27,000 email addresses were exposed, with usernames, MD5-hashed passwords, credit card numbers and support tickets.
View all 13,115 breaches- Breach date
- 11 Mar 2016
- Affected
- 26,815
- Data exposed
- Credit cards, Email addresses, IP addresses, Passwords, Support tickets, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In March 2016, Staminus, a company that sold DDoS protection and hosting, was hacked. Krebs on Security reported that the attack took the company's network offline for more than 20 hours. Soon after, a trove of Staminus data was published online. Have I Been Pwned dates the breach to March 11, 2016 and added it on October 5, 2017. It counts about 27,000 unique email addresses (26,815).
Staminus said it had notified law enforcement, including the FBI. The company is no longer in operation, so there is nobody to ask for a notice or to offer credit monitoring.
What was exposed
According to Have I Been Pwned, the leak included email addresses, usernames, passwords (stored as unsalted MD5 hashes, a weak method that is easy to crack), credit card numbers, support tickets and IP addresses. The company has said customer contact details were also involved, and that it didn't collect Social Security numbers.
Staminus customers were mostly businesses and website operators, so the emails are often work addresses. That matters for phishing: a message that names the hosting provider you used, or quotes an old support ticket, looks credible. The password hashes are the other risk. Unsalted MD5 can be cracked quickly, so assume any password used with Staminus is known, along with any other account where you reused it.
What to do
The breach is old, and the card numbers are long expired in most cases. The practical risk now is reused passwords and targeted phishing. Check whether your email appears here and in other breaches, change anything that shares an old password, and turn on two-factor login.
What to do if you were in it
- 1
Change any password you reused
If you had a Staminus account, change the password on every other site where you used the same or a similar one. Use a password manager so each account gets its own.
- 2
Turn on two-factor login
Use an authenticator app or passkey on email, banking and work accounts. It blocks most takeovers even if an old password is known.
- 3
Expect phishing that mentions hosting or support tickets
Be wary of emails about your hosting account, billing or an old support request. Open the provider's site yourself instead of clicking links.
- 4
Check the card you used
If you paid Staminus by card, look for charges you don't recognize on that card and ask the issuer for a new number if it's still active.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see which breaches include your details and what to do about each.
Frequently asked
Was I affected by the Staminus breach?
If you had a Staminus account or used a service it hosted, possibly. Have I Been Pwned lists 26,815 email addresses from the leak, and you can look yours up there or run a free Serus scan.
What was exposed in the Staminus breach?
Email addresses, usernames, passwords stored as unsalted MD5 hashes, credit card numbers, support tickets and IP addresses, according to Have I Been Pwned.
Should I change my password?
Yes, if you used a Staminus password anywhere else. Unsalted MD5 hashes can be cracked, so treat that password as known.
Sources
- Have I Been Pwned: Staminus
- haveibeenpwned.com/Breach/Staminus
- krebsonsecurity.com/2016/03/hackers-target-anti-ddos-firm-staminus/
- tripwire.com/state-of-security/hackers-breach-ddos-protection-firm-staminus-leak-sensitive-data-online
- bankinfosecurity.com/hackers-attack-ddos-defense-hosting-firm-a-8964
Something wrong or out of date? Tell us and we'll re-check it.
