Grupo canadense de hospedagem não nomeado · Breach

Threat actor claims sale of 3.75 million Hostwinds customer records

Nov 02, 2026 · 1 min read

A threat actor on a dark web forum is selling for $4,000 what they claim is about 3.75 million records from a Canadian hosting group whose brands include Hostwinds, Hostopia, ColoCloud, ChicagoVPS, HudsonValleyHost and Managed.com. The claimed lot includes about 793K billing-system records, 1.29M email mailboxes, 1.07M Hostopia control panel accounts and 592K domain-to-mail-server mappings. The claim is unverified; per the source, the sale lands days after Hostwinds disclosed unauthorized access to its client area and billing system on Oct 22, and customers of these brands should reset passwords and turn on MFA.

By HIFY Radar newsroom Updated 11/02/2026 06:14 AM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A threat actor on a dark web forum claims to have stolen about 3.75 million customer records from a Canadian hosting group whose brands include Hostwinds, Hostopia, ColoCloud, ChicagoVPS, HudsonValleyHost and Managed.com, and offers them for $4,000. The claim is unverified. Per the source, Hostwinds disclosed unauthorized access to its client area and billing system on Oct 22.

Why it matters

If genuine, the data exposes names, emails, locations, phone numbers, mailboxes and control panel accounts of hosting customers. The source warns of phishing posing as hosting or domain renewal notices, business email compromise and hosting account takeover.

What to do

Reset passwords on accounts with these brands, turn on MFA and brief staff on fake hosting and domain renewal emails.

For the technical team

Affected: Grupo canadense de hospedagem não nomeado (marcas incluem Hostwinds, Hostopia, ColoCloud, ChicagoVPS, HudsonValleyHost e Bases de clientes do grupo de hospedagem; lote alegado com cerca de 3,75 milhões de registros à venda por US$ 4 mil em f · Customers of the brands Hostwinds, Hostopia, ColoCloud, ChicagoVPS, HudsonValleyHost and Managed.com, part of a Canadian hosting group.
Exploitation: Sale claimed by a threat actor on a dark web forum, reported by DailyDarkWeb; claim not confirmed by the company. No technical exploitation reported.
Fix: No fix applicable; the source recommends resetting passwords and turning on MFA.
Vector: Alleged data leak. Per the source, Hostwinds disclosed unauthorized access to its client area and billing system on Oct 22; the method of the claimed theft is not described.
More details: Claimed lot: about 793K billing-system records (names, emails, locations, phone numbers), 1.29M email mailboxes, 1.07M Hostopia control panel accounts, 592K domain-to-mail-server mappings, plus hosting and domain tables. Asking price: $4,000. The source warns of phishing posing as hosting or domain renewal notices, business email compromise and hosting account takeover.