Skip to main content

Aruba waited months to notify customers regarding a recent data breach

Hacker Typing
(Image credit: Shutterstock)
Audio player loading…

The Italian web hosting (opens in new tab) company Aruba (opens in new tab) admitted that it recently fell victim to a data breach after its customers complained online that it had waited too long to notify them regarding the situation.

As reported (opens in new tab) by The Daily Swig, the company informed its customers in a message sent out last week that it had fallen victim to a data breach (opens in new tab) back in mid-April which exposed their personal data including full names, tax codes, physical addresses, telephone numbers, emails and encrypted hashes of customer portal passwords.

  • We've put together a list of the best CMS (opens in new tab) solutions available
  • These are the best web hosting (opens in new tab) services on the market
  • Also check out our roundup of the best password manager (opens in new tab)

At that time, Aruba reset customer passwords though it waited around ten weeks until after its investigation into the matter was complete to send out a data breach notification (opens in new tab) to those affected.

Better late than never

In a statement to The Daily Swig, an Aruba spokesperson explained that its cybersecurity detection systems discovered anomalous activity that was found to be unauthorized access back in April. 

The company's incident response team then blocked the intruder's access to its systems while it investigated further. As a result of the investigation, Aruba learned that a vulnerability in a third-party CMS (opens in new tab) was exploited by the attacker to gain access. From here the company informed the authorities and the Personal Data Protection Authority.

During the last two months, Aruba has been working closely with the authorities and cybersecurity experts “to investigate the depth and potential repercussions of the attempted access to or misuse” of its data. Following the completion of its investigation, the company notified customers that a breach had occurred while providing advice and support.

Some of Aruba's customers though took issue with the fact that the company waited as long as it did to inform them of the data breach. To Aruba's credit though, it did reset customer passwords (opens in new tab) immediately after discovering the breach.

At this time, we still don't know how many customers were affected and Aruba has said that the attackers responsible have not yet reached out to the company.

Via The Daily Swig (opens in new tab)

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.