- FirstVDS said attackers exploited a vulnerability in ISPsystem’s VMmanager 6.
- The Record said malware copied passwords, cloud credentials, configuration files, cryptocurrency wallets and other files.
- FirstVDS said the vulnerability was not fully fixed after ISPsystem’s patches.
Attackers exploited a vulnerability in ISPsystem’s VMmanager 6 platform to access data on some FirstVDS customers’ virtual servers, FirstVDS said. The hosting provider discovered the attack on Saturday and said it affected part of its infrastructure.
The Record reported that the attackers deployed malware to copy passwords, cloud-service credentials, configuration files, cryptocurrency wallets and other files. FirstVDS said the data was transferred to a server controlled by the attackers, while affected virtual servers continued operating normally.
The Record said FirstVDS rents virtual private servers for websites, applications, databases and other online services, including servers hosted in the Netherlands and Kazakhstan. FirstVDS said attackers reached customer data without directly compromising the virtual machines themselves.
On this page
VMmanager malware copied data without changing virtual-server files
The Record reported that the malware mounted virtual-server disks in read-only mode. That allowed it to copy information without modifying files or disrupting normal operations.
FirstVDS said the attackers accessed customer data without directly compromising the virtual machines themselves. It also said there were no traces of the attack on affected servers, which continued to operate normally.
FirstVDS restricted VMmanager access after the attack
FirstVDS said it disabled external access to the vulnerable management system and blocked communications with the attackers’ server. The Record said the provider was operating with restrictions, including limited availability of VMmanager functions.
The Record reported that ISPsystem had released several patches, including an update deployed overnight on Monday. FirstVDS said those updates had not fully fixed the vulnerability.
FirstVDS disabled external access to the vulnerable management system and blocked communications with the attackers’ server. It said the breach affected only part of its infrastructure, but did not disclose how many customers or servers were compromised.
The Record said the identity and motives of the hackers remained unknown. It also said FirstVDS had not disclosed how the attackers initially exploited the vulnerability or which software versions were affected.
FAQ
What happened at FirstVDS?
FirstVDS said attackers exploited a vulnerability in ISPsystem’s VMmanager 6 and accessed data on some customers’ virtual servers. It discovered the attack on Saturday.
What data did the FirstVDS attackers copy?
The Record said the malware copied passwords, cloud-service credentials, configuration files, cryptocurrency wallets and other files from customers’ virtual servers.
Were FirstVDS virtual machines compromised?
FirstVDS said attackers accessed customer data without directly compromising the virtual machines themselves. The affected servers continued to operate normally.
How many FirstVDS customers were affected?
FirstVDS said the breach affected only some of its infrastructure but did not disclose how many customers or servers were compromised.
Sources
- An Update on the Recent Klue Security Incident - Klue, KluePrimary
- Hackers steal customer data from major Russian hosting provider FirstVDS, The Record
- Klue says hackers stole credential from 2022 that led to customer data breaches, TechCrunch
- Revolut reportedly facing $3m ransom demand after hackers steal hundreds of customers’ data, The Guardian
How we checked this story
| Claim | Source | Status |
|---|---|---|
| The Record reported that hackers stole passwords, access credentials and other sensitive data belonging to FirstVDS customers. | The Record | Attributed |
| FirstVDS said the attack was discovered on Saturday and affected part of its infrastructure. | FirstVDS, via The Record | Attributed |
| The Record said hackers accessed data stored on customers’ virtual servers without disrupting their operations. | The Record | Attributed |
| FirstVDS said attackers exploited a vulnerability in VMmanager 6, a virtualization management platform developed by ISPsystem. | FirstVDS, via The Record | Attributed |
| The Record said the hackers deployed malware to copy passwords, cloud service credentials, configuration files, cryptocurrency wallets and other files from customers’ virtual servers. | The Record | Attributed |
| FirstVDS said the stolen information was transferred to a server controlled by the attackers. | FirstVDS, via The Record | Attributed |
| FirstVDS said the breach affected only some of its infrastructure but did not disclose how many customers or servers were compromised. | FirstVDS, via The Record | Attributed |
| The Record said firstVDS has operated since 2002 and rents virtual private servers for websites, applications, databases and other online services. | The Record | Attributed |
| The Record said firstVDS offers servers hosted outside Russia, including in the Netherlands and Kazakhstan. | The Record | Attributed |
| FirstVDS said attackers accessed customer data without directly compromising the virtual machines themselves. | FirstVDS, via The Record | Attributed |
| The Record said the malware mounted virtual-server disks in read-only mode, allowing it to copy information without modifying files or disrupting operations. | The Record | Attributed |
| FirstVDS said affected virtual servers continue to operate normally without traces of the attack. | FirstVDS, via The Record | Attributed |
| FirstVDS disabled external access to the vulnerable management system and blocked communications with the attackers’ server. | FirstVDS, via The Record | Attributed |
| The Record said iSPsystem released several patches after the breach, including an update deployed overnight on Monday. | The Record | Attributed |
| FirstVDS said the vulnerability had not yet been fully fixed after ISPsystem’s patches. | FirstVDS, via The Record | Attributed |
| The Record said as of Monday, FirstVDS was operating with restrictions including limited availability of VMmanager functions. | The Record | Attributed |
| The Record said firstVDS had not disclosed how attackers initially exploited the vulnerability or which software versions were affected. | The Record | Attributed |
| The Record said the identity and motives of the hackers remained unknown. | The Record | Attributed |
| Klue said it identified unauthorized activity affecting part of its integration infrastructure on June 12. | Klue | Confirmed |
| Klue said an attacker used a compromised legacy integration-service credential to obtain OAuth tokens. | Klue | Confirmed |
| Klue said the attacker used OAuth tokens to access data in connected customer environments through third-party platforms including Salesforce. | Klue | Confirmed |
| Klue said the incident was limited to affected third-party platforms and found no evidence that customer content stored in Klue was impacted. | Klue | Confirmed |
| Klue said it revoked affected credentials and tokens, removed unauthorized code, disabled potentially impacted integrations, launched an investigation and notified law enforcement. | Klue | Confirmed |
| Klue said it communicated directly with affected customers and shared investigative findings and response support. | Klue | Confirmed |
| Klue said it engaged CrowdStrike to support its investigation and validate its response. | Klue | Confirmed |
| Klue described the incident as a deliberate criminal act. | Klue | Confirmed |
| TechCrunch reported that Klue detected the hack on June 12 and first disclosed it the following Friday. | TechCrunch | Attributed |
| Klue said the credential used to steal customer data was originally provided to a third party in 2022 for a limited pilot. | Klue, via TechCrunch | Attributed |
| TechCrunch said the breach affected Klue customers including LastPass and several other cybersecurity companies. | TechCrunch | Attributed |
| TechCrunch said the hackers used Klue’s access to download customer data from other clouds and databases and extort companies. | TechCrunch | Attributed |
| TechCrunch said klue did not explain the pilot’s purpose or duration, identify the third party, or explain why the credential was not revoked after the pilot ended. | TechCrunch | Attributed |
| TechCrunch said klue said its investigation was continuing. | TechCrunch | Attributed |
| TechCrunch said klue described the stolen credential only as a legacy credential associated with an integration service. | TechCrunch | Attributed |
| TechCrunch said icarus claimed responsibility for the Klue breach and threatened to release the stolen data if its ransom was not paid. | TechCrunch | Attributed |
| The Guardian said the Revolut breach affected about 680 of its 80 million global customers. | The Guardian | Attributed |
| Revolut said it had not received direct contact or a demand from the individuals or group making the ransom claims. | Revolut, via The Guardian | Attributed |
| Revolut said an unauthorized third party used a legitimate government-agency domain email to submit fraudulent information requests. | Revolut, via The Guardian | Attributed |
| Revolut said it immediately blocked the address and alerted the government agency, enforcement agencies, data-protection authorities and financial regulators. | Revolut, via The Guardian | Attributed |
| Mark Karpelès said he feared for his family’s safety because the breached files contained his address. | Mark Karpelès, via The Guardian | Attributed |
| The Guardian said karpelès said a victim was told the victim’s personal details would be deleted only after paying $50,000. | The Guardian | Attributed |
| klue.com published its report on Jun 19, 2026. | klue.com | Confirmed |
Could not verify
- How many customers or servers were compromised is not established.
- How attackers initially exploited the vulnerability is not established.
- Which VMmanager versions were affected is not established.
- Whether the vulnerability has been fully fixed is not established.
Related stories
Vulns & PatchesFortiSIEM flaw CVE-2026-106173 could enable arbitrary file writes
Vulns & PatchesSafePay ransomware advisory details activity affecting at least 600 victims
Vulns & PatchesAPT28 targeted European military and law enforcement organizations