I got an email...
It said the following,
Dear support portal user,
as you may have noticed, our portal has been unavailable. We identified an unknown party's attempt to breach the Flowmon's support portal yesterday. As a part of the internal security process, we took the portal offline.
While we detected the attack attempt right away, and we immediately took security measures to prevent any damages, some user account data (e-mail, name, password hash) could have been compromised. Therefore, we're taking security precautions and we also recommend you to change your passwords in case you use same credentials to multiple applications.
We expect to bring the portal back up next week, and we will keep you posted. We are upgrading our systems to encrypt the password data better.
Furthermore, for the past two months, we have been in the process of replacing the portal's underlying technology, and we expect the new portal will be launched in the first half of this year. Alongside an increased level of security, it will bring enhanced experience including asset management and new content.
We are dedicated to security, and we will keep updating and upgrading our systems to prevent such events in the future.
This won't make anyone happy — especially when it comes from a company whose entire business is built on cyber security. The first thing you want to know in such a situation is the password to that service. For several reasons:
- Am I still using that password anywhere else? (Many users use one and the same password for multiple services, the same password at home and at work,...) — so I can change it everywhere.
- How strong was that password (assuming it had fewer than 8 characters and the hashing algorithm chosen was poor, you can almost certainly say the attacker(s) will crack it very soon).
Both points essentially come down to the same thing — immediately change the password(s) on all affected services. Nothing is worse than someone compromising your account through a password that is publicly known and available.
By the way, if you run a website and store passwords in MD5 or SHA1, you're doing it wrong. Use the more modern and better bcrypt.