Menu
Mandrill warns attack may have exposed some data about email

Mandrill warns attack may have exposed some data about email

The transactional email service said it doesn't believe data was stolen

Mandrill warned customers on Wednesday that some email-related data may have been exposed after attackers tried to lasso some of its servers into a botnet.

Data doesn't appear to have been stolen, but some customers should take some security precautions, wrote Brandon Fouts, general manager of Mandrill, which is a platform for managing transactional email that is owned by The Rocket Science Group.

"There's not evidence that any customer data was queried or exported, but unfortunately we can't completely rule out the possibility of access," Fouts wrote in a blog post.

Data that may have been exposed includes internal logs about emails sent, including sender and recipient addresses but not custom metadata or the content of messages, Fouts wrote.

The customers who may have been affected used Mandrill to send email between Feb. 6 and March 10 and used Mandrill's SMTP integration to send mail. Mandrill is contacting those believed to be at risk by email.

Customers who used Mandrill's SMTP integration should deactivate all API (application programming interface) keys and generate new ones as a precaution, Fouts wrote.

The attack came after Mandrill made a change to a firewall on Feb. 20 to allow more granular access to some of the company's servers.

"As a result, a cluster of servers hosting Mandrill's internal application logs was made publicly accessible instead of allowing internal-only access," Fouts wrote.

Mandrill discovered the vulnerability on March 10 after attackers unsuccessfully tried logging into those internal logging servers.

Log files on the affected servers have been backed up, and those servers won't be used anymore, Fouts wrote. SSH (Secure Shell) keys and Mandrill's API keys and passwords have been changed.

"We are deeply sorry for our error," Fouts wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the newsletter!

Error: Please check your email address.

Tags Internet-based applications and servicesThe Rocket Science GroupsecurityMailinternetprivacy

Featured

Slideshows

Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP honoured leading partners across the channel at the Partner Awards 2017 in New Zealand, recognising excellence across the entire print and personal systems portfolio.

Meet the top performing HP partners in NZ
Tech industry comes together as Lexel celebrates turning 30

Tech industry comes together as Lexel celebrates turning 30

Leading figures within the technology industry across New Zealand came together to celebrate 30 years of success for Lexel Systems, at a milestone birthday occasion at St Matthews in the City.​

Tech industry comes together as Lexel celebrates turning 30
HP re-imagines education through Auckland event launch

HP re-imagines education through Auckland event launch

HP New Zealand held an inaugural Evolve Education event at Aotea Centre in Auckland, welcoming over 70 principals, teachers and education experts to explore ways of shaping and enhancing learning using technology.

HP re-imagines education through Auckland event launch
Show Comments