ZAP-Hosting zap-hosting.com ZAP-Hosting data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
A database dump from ZAP-Hosting's customer portal, dated November 2021, appeared online in March 2022. It covered about 746,000 email addresses, plus names, phone numbers, physical addresses, purchases, IP addresses and support chats.
View all 13,118 breaches- Breach date
- 22 Nov 2021
- Affected
- 746,682
- Data exposed
- Browser user agent details, Chat logs, Email addresses, IP addresses, Names, Phone numbers, Physical addresses, Purchases
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
ZAP-Hosting is a German game server and web hosting company. In March 2022 a copy of its customer portal database went public. The dump was dated 22 November 2021, and Have I Been Pwned added it to its index in March 2022 after reviewing it.
Have I Been Pwned counts about 746,000 unique email addresses in the data, spread across more than 60GB. Besides the addresses, the files held customer names, phone numbers, physical addresses, IP addresses, purchase records and support chat logs. Browser user agent details were in there too.
ZAP-Hosting said it had no knowledge of the leak before the data was published, and that it had seen attacks on its internal services between 13 and 15 March 2022. It called a link between the two incidents highly probable. The company also said customer portal passwords were stored only in encrypted form. The exception was some subuser accounts, whose auto-generated passwords had been logged in the database. It said it reset those and offered customers a 20 euro voucher.
What the exposed data lets someone do
A name, an email address, a phone number and a home address together are enough to write a convincing message. Because the support chats and purchase history are tied to a hosting account, scammers can reference a real server order or a ticket you opened. Expect phishing emails and texts posing as ZAP-Hosting or a payment provider, and be wary of any message that asks you to log in through a link.
If you reused your ZAP-Hosting password, or used a subuser account on a server, change that password and every place you used it.
Sources checked: haveibeenpwned.com, zap-hosting.com, privacy-web.nl
Last verified against the official page:
What to do if you were in it
- 1
Change your ZAP-Hosting password
Pick a new one that you use nowhere else, and change any other account that shared it. Subuser accounts had generated passwords logged, so reset those too.
- 2
Turn on two-factor login
Use an authenticator app on your ZAP-Hosting account and on your email. It stops a stolen password from being enough on its own.
- 3
Treat messages about hosting orders with suspicion
Your name, phone number and order history were in the data. Don't click links in texts or emails about invoices, servers or support tickets. Go to the site directly instead.
- 4
Watch for mail at the address you gave
Physical addresses were exposed. Be skeptical of unexpected parcels, letters or calls that quote your address.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at Serus to see which breaches your email or phone appears in and what to do about each.
Timeline
-
The breach happened
-
Added to Have I Been Pwned
Frequently asked
Was I affected by the ZAP-Hosting breach?
If you had a ZAP-Hosting customer account in 2021 or earlier, possibly. Search your email address on Have I Been Pwned, or run a free Serus scan, to see whether it appears.
What was exposed in the ZAP-Hosting breach?
Email addresses, names, phone numbers, physical addresses, IP addresses, purchases, support chat logs and browser user agent details, according to Have I Been Pwned.
Were passwords leaked?
ZAP-Hosting said customer portal passwords were included only in encrypted form. Some subuser accounts had auto-generated passwords logged in plain form, and the company said it reset them.
Should I change my password?
Yes, if you reuse it anywhere. Change it on ZAP-Hosting and on every other site that shares it, and turn on two-factor login.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
