“We have been made aware that we may have been a victim of a security breach in which access was made to one of our servers,” Too Much Media co-founder John Albright told XBIZ. “It appears that certain non-unique usernames and passwords we maintained for administrative support of our clients were compromised.”
Albright said that in light of the breach, “all passwords have been changed and passwords will be no longer be maintained by TMM.”
According to Albright, no credit card information was at risk due to the breach, and that “preliminary indications are that the hacker was after email lists.”
Asked how long TMM had been aware of the breach, Albright said that there had been a “lot of misrepresentation [as] to this,” but verified that the company did “become aware of an issue a few months ago.”
“We had determined what we at the time thought to be the extent of it and notified those who were affected,” Albright said. “Also, as a precaution, we changed all of the admin passwords we maintained regardless of whether we had an indication they had been compromised or not. As soon as we became aware of the issue being more widespread we immediately contacted all of our clients and took the actions mentioned previously.”
Albright took exception to the notion that the company had not notified its clients in a timely fashion, and defended the company’s actions as being appropriate given the perceived degree of the breach’s severity at the time it was first discovered.
“This is something being misrepresented by people,” Albright said. “We take our security and the security of our clients very seriously. [W]e contacted everyone we thought had been affected when we first knew of the issue and we contacted all clients as soon as we learned the issue was more widespread.”
Asked what NATS clients should do in the short term to improve security on their end, Albright said TMM is “recommending all clients utilize the admin IP restriction feature which has been available in NATS for some time.”
“Many clients had already taken advantage of this and other security features in NATS and were not affected by this breach,” Albright said, adding that TMM has been in touch with their clients in order to gather information and to advise their clients about what steps to take.
“We have asked via statements, emails to clients, and news items posted in the NATS admin news and on our website that people submit a support ticket so we may advise them of the best actions to take,” Albright said. “We have also taken actions on our end to change all passwords to any installs which may have been compromised and we are no longer maintaining those passwords. We have modified our policy to no longer keep any passwords of any sort. Clients will need to grant us access to their install when any work is to be performed.”
Albright said that an investigation is now underway to determine “the exact cause and level of the security breach.”
“TMM intends to prosecute to the fullest extent possible anyone responsible for any breach of its servers and programs,” Albright said.
In a statement issued over the weekend, Albright said that his company’s handling of the situation had not been ideal and apologized for not taking more extensive action sooner, but attributed its limited actions to the fact that TMM was not aware of the full scope of the problem.
“If we had known that the issue was more widespread we would have without question contacted everyone,” Albright said in the statement. “We did not believe at the time it was a widespread issue. Again, this was a mistake on our part and I apologize to everyone for it. I was not trying to put blame on our clients for this and I'm sorry if I was taken that way. I was simply trying to point out the various possibilities as to what may have been going on while we were investigating it. This is not our [clients’] fault in any way.”