Since yesterday, 21 March 2024, altHUB has been under attack. Looking further into logs it looks as though what took our database load balancer offline was in fact a DDoS attack.
This has escalated to what looks like a credential stuffing attack against various altHUB users along with, potentially email enumeration attacks (these are yet to be confirmed)f
With the help of Cloudflare we've enabled additional measures to help mitigate the attack, but we cannot be certain that work arounds may still happen. We're monitoring this very closely. This may result in degraded performance across altHUB services, we're doing everything we can to remain stable. Please see a brief FAQ section below, users are welcome to contact us with questions > https://help.althub.co.za/contact/
Has there been a security breach at altHUB?
No. We've thoroughly reviewed logs and can confidently say that there has been no security incident or breach on altHUB servers.
Why is this happening?
We aren't sure, typically credential stuffing attacks happen to take over acccounts. We saw a DDoS attack once we blocked the initial attempt.
Have affected users been contacted?
Yes, along with accounts being disabled. Affected users are strongly encouraged to update their password, ideally from a password manager, and consider using a different email address.
Updates to follow.