back to article Solarwinds sends customers each others' complete client lists

Software company Solarwinds, which sells IT management tools, has infuriated customers after a faulty alert exposed customers' entire client lists to their competitors. An unspecified issue affecting the Texas-based business' RemoteManagement tool, which it gained after acquiring Dundee-based LogicNow, led to a mass leaking of …

  1. Doctor Syntax Silver badge

    It looks as if the cut and paste is still working: it was only a few customers' data released.

  2. GingerOne

    So what was sent? Just their computer names? Apart from perhaps having a laugh at randon server names or seeing how quickly you can work out the purpose of the non-random server names what's the big deal?

    1. Anonymous Coward
      Anonymous Coward

      @GingerOne

      Hopefully your just having a laugh.. but if not....

      Although while not a direct attack, knowing the naming conventions of systems within a targets environment is generally a great step forward in gaining unauthorised access to a system. Being able to call in to said target and being able to reel off a list of machine names etc will more than likely assist with a social engineering attack by often proving enough familiarity with the network to gain trust.

      I would be very angry if any customer I looked after had had their details leaked knowing what could be on the way after such a breach of information. And before anyone says it wasn't sent to external customers. Do you want your systems security safe guarded by a competitor? Or do you trust them not to accidently let your details "slip" to the wider world?

      1. djack

        Re: @GingerOne

        I would be very angry if any customer I looked after had had their details leaked knowing what could be on the way after such a breach of information.

        if I were a Solarwinds customer in this case, I'd be worried what level of legal liability I would have to my customers if their data was involved in this.

        1. John Brown (no body) Silver badge

          Re: @GingerOne

          "if I were a Solarwinds customer in this case, I'd be worried what level of legal liability I would have to my customers if their data was involved in this."

          Well, Solarwinds won't be worrying too much. They are in Texas and almost certainly have something in their contracts stating that all legal actions must take place in a Texas court. And well know how that works out, especially for foreign companies going after not just a US company, but a real live Texas company.

  3. Anonymous Coward
    Anonymous Coward

    The Cloud...

    ...where your tools run, but you have no security or control over them.

    This could not have happened with an on-premise tool, where you were in complete control of the mailing list destination and mail servers.

    1. Adam 52 Silver badge

      Re: The Cloud...

      Yes, just ask the NHS. They've never accidentally put everyone's name on the the cc list.

      1. djack

        Re: The Cloud...

        That's a case in point. It was a dedicated NHS system so the 'damage' was contained with in the NHS.

        Aside from a deliberate act, there's no conceivable way that, say, everyone's data can be sent to BUPA. However if they both used a shared third-party cloud platform, you cannot make such an assertion.

        1. Adam 52 Silver badge

          Re: The Cloud...

          Was it? Details of people's HIV status exposed to the Internet. Not really contained...

    2. LDS Silver badge

      Re: The Cloud...

      Time to rename it "thunderstorm"? This time it rained a lot of data...

  4. JimmyPage
    FAIL

    And in other news, an industrial size call centre

    has been uncovered devoted to scamming Talk Talk customers.

    http://www.bbc.co.uk/news/technology-39177981

    Some data breaches are so serious, there *has* to be restitution to the affected.

    (We'll gloss over how I predicted this would happen back in Nov 2015 ...)

  5. kain preacher

    I'm sure the cloud works for some people. it just seems when it goes bad it's huge cock up. Lets see we saw gitlab explode. AWS Fell over so bad that not even Amazon could access their own dash board. Now emailing customers info to others.

  6. Androgynous Cow Herd

    We managed to lock the barn

    immediately after theft of the horse.

  7. Ken Moorhouse Silver badge

    RemoteManagement

    Does this describe the product or...

  8. EnviableOne Silver badge
    WTF?

    Whats Testing?

    so nobody really tested the update, just pushed the thing out and borked all the security. Nicely done Solarwinds, goes to show your putting the extortionate support fees to good use.

  9. Steve Potter

    Been there done that.

    Its not an uncommon event it seems.

    They sent me an invoice last year, and besides mine the emailed PDF contained EVERY invoice on their system... quite a large file with all their customers details... tut tut.

    I duly let them know... and nothing, not even an acknowledgement.

    Steve

  10. cjmod

    What update caused this?

    Solarwinds didn't even announce an update was scheduled - status.solarwindsmsp.com

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like

Biting the hand that feeds IT © 1998–2022