Kaspersky's US website hacked
The US Kaspersky site admits a vulnerability which hackers used to access its private database.
A SQL injection attack was used to break into Kaspersky's database, gaining access to "everything," according to the hackers, who claimed visibility of user accounts, activation codes and customers' personal details.
Kaspersky admitted in a statement that a subsection of the usa.kaspersky.com domain detected a vulnerability at the weekend which a hacker tried to attack. Upon detection, Kaspersky Lab USA took action to roll back the subsection of the site to eliminate the risk.
The Russian company has stressed that the attack didn't affect the UK site in any way. The US website infrastructure is hosted and operated independently, so the breach was confined to the US only.
Both the hackers and Kaspersky stressed that the attack was not malicious, and that no data was exploited due to the flaw. "Kaspersky['s] team doesn't need to worry about us spreading their confidential stuff," the hackers said on their blog in response to a story on The Register.
"Our staff will never save or keep any confidential data. We just point our fingers to the big websites with security problems. We hope to see that vulnerability patched very soon (If it isn't already patched)."
It's alleged that Kaspersky wasn't the only security vendor to be hit by the hackers. They claimed they had also broken into the Portuguese version of BitDefender's company website, accessing personal details and email addresses.
BitDefender said in reply that the site hacked was not owned or operated by it. It said: "A partner site was compromised and we are working to investigate exactly what happened so we can help our partner prevent this from happening again."
What you need to know about migrating to SAP S/4HANA
Factors to assess how and when to begin migrationDownload now
Your enterprise cloud solutions guide
Infrastructure designed to meet your company's IT needs for next-generation cloud applicationsDownload now
Testing for compliance just became easier
How you can use technology to ensure compliance in your organisationDownload now
Best practices for implementing security awareness training
How to develop a security awareness programme that will actually change behaviourDownload now