Menu
Mandrill warns attack may have exposed some data about email

Mandrill warns attack may have exposed some data about email

The transactional email service said it doesn't believe data was stolen

Mandrill warned customers on Wednesday that some email-related data may have been exposed after attackers tried to lasso some of its servers into a botnet.

Data doesn't appear to have been stolen, but some customers should take some security precautions, wrote Brandon Fouts, general manager of Mandrill, which is a platform for managing transactional email that is owned by The Rocket Science Group.

"There's not evidence that any customer data was queried or exported, but unfortunately we can't completely rule out the possibility of access," Fouts wrote in a blog post.

Data that may have been exposed includes internal logs about emails sent, including sender and recipient addresses but not custom metadata or the content of messages, Fouts wrote.

The customers who may have been affected used Mandrill to send email between Feb. 6 and March 10 and used Mandrill's SMTP integration to send mail. Mandrill is contacting those believed to be at risk by email.

Customers who used Mandrill's SMTP integration should deactivate all API (application programming interface) keys and generate new ones as a precaution, Fouts wrote.

The attack came after Mandrill made a change to a firewall on Feb. 20 to allow more granular access to some of the company's servers.

"As a result, a cluster of servers hosting Mandrill's internal application logs was made publicly accessible instead of allowing internal-only access," Fouts wrote.

Mandrill discovered the vulnerability on March 10 after attackers unsuccessfully tried logging into those internal logging servers.

Log files on the affected servers have been backed up, and those servers won't be used anymore, Fouts wrote. SSH (Secure Shell) keys and Mandrill's API keys and passwords have been changed.

"We are deeply sorry for our error," Fouts wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags privacyinternetMailInternet-based applications and servicesThe Rocket Science Group

Featured

Slideshows

Reseller News welcomes industry figures for 2019 Hall of Fame lunch

Reseller News welcomes industry figures for 2019 Hall of Fame lunch

Reseller News welcomed 2018 inductees - Chris Simpson, Kendra Ross and Phill Patton - to the third running of the Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed the changing landscape of the technology industry in New Zealand, while outlining ways to attract a new breed of players to the ecosystem. Photos by Gino Demeer.

Reseller News welcomes industry figures for 2019 Hall of Fame lunch
Upcoming tech talent share insights at inaugural Emerging Leaders Forum 2019

Upcoming tech talent share insights at inaugural Emerging Leaders Forum 2019

The channel came together for the inaugural Reseller News Emerging Leaders Forum in New Zealand, created to provide a program that identifies, educates and showcases the upcoming talent of the ICT industry. Hosted as a half day event, attendees heard from industry champions as keynoters and panelists talked about future opportunities and leadership paths and joined mentoring sessions with members of the ICT industry Hall of Fame. The forum concluded with 30 Under 30 Tech Awards across areas of Sales, Entrepreneur, Marketing, Management, Technical and Human Resources. Photos by Gino Demeer.

Upcoming tech talent share insights at inaugural Emerging Leaders Forum 2019
Show Comments