Networking device maker Ubiquiti announced Monday, January 11, 2021, that it had suffered from a data breach. A brief announcement was made over email saying a security incident may have compromised customer information.
Ubiquiti is a key player and vendor of cloud-enabled Internet of Things (IoT) devices. As one of the major merchants of networking gear, it is best known for its UniFi wired and wireless network products report Bleeping Computer.
Among the products under its name are smart home gear, antennas, and switches state IT News.
In its email to customers, Ubiquiti said, “We recently became aware of unauthorized access to certain of our information technology systems hosted by a third party cloud provider. We have no indication that there has been unauthorized activity with respect to any user’s account.”
The announcement to customers follows a weekend where the company’s UniFi cloud management platform suffered a massive outage for the weekend. This led to users being unable to gain access to the mobile app, website, and from controlling their devices, reports Bleeping Computer.
ZD Net states that while the company did not name the third-party service provider, the system in question pertains to a web portal called account.ui.com. This is a website that Ubiquiti provides to customers who have bought their products.
Apart from being a customer support platform, account.ui.com is also considered a website to help users manage their devices even from a remote location.
Among the compromised data include customer names, email addresses, as well as salted and hashed passwords, reports Tech Crunch.
Besides this, the company also said that physical mailing or billing addresses, as well as phone numbers, may also be vulnerable. However, this may only be the case provided that customers included such data within the portal, notes ZD Net.
Although the passwords in question remain scrambled, Ubiquiti urges its customers to immediately change their passwords. Moreover, the company also moves its users to enable the two-factor authentication for additional security measures when it comes to protecting passwords from malicious hackers or threat actors, notes Tech Crunch.
As of writing, the company has yet to disclose the number of affected individuals by the data breach. Despite the incident, the networking device maker maintains that it had not yet seen threat actors gain unauthorized access to customer accounts.
After the initial email, Tech Crunch revealed that a number of customers complained about the authenticity of the document due to typographical errors. This led Ubiquiti to issue another post saying its email is legitimate.
