Web biz DomainFactory confirms: We were hacked in January 2018 German hosting company DomainFactory has taken down its forums after someone posted messages alleging to have compromised the company's computers. Acknowledging the attack, the GoDaddy-owned (via Host Europe, acquired in 2016) company has advised customers to change their passwords and detailed the extent of the data breach …
>>> “ the following categories of data: Customer name; Company name; Customer number; Address; E-mail addresses; Phone number; DomainFactory Phone password; Date of birth; Bank name and account number (eg IBAN or BIC); and Schufa score”
Huh? Schufa score? As a standard entry?
For people unfamiliar with German Schufa: it's a credit check private company
Now, I'm pretty sure this is not a common question, or even data "average" Germans know the answer to, or for that matter, have access to. This kind of implies that the hosting company is pulling up all your financial details by default? For buying a TLD (e.g. an .de ≤ € 0.99*)? Maybe I'm an old, paranoid, asocial, "have nothing to share" fart but... WTF? Please tell me I'm wrong...
This type of data should be encrypted in the db, then it is far more difficult for the hacks to get the raw data WHOLESALE.
All too often seems they hack the db and have all the data they need as its stored in plain text.
ENCRYPT personal/sensitive data and avoid this (or at least make it more difficult by encrypting it).
For security management looking to make headway on earning a "Get Out of Jail Free" card with auditors for when a breach occurs, "Encrypt Everything Everywhere" is the way of the now.
It's not everything that needs to be done, of course, but it's a huge start.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
