DigitalOcean, a popular web-hosting platform, DigitalOcean provides developers cloud services that help to deploy and scale applications that run simultaneously on multiple computers. As of January 2018, DigitalOcean was the third-largest hosting company in the world in terms of web-facing computers.

Recently, Digital Ocean has started informing customers about a data leak that “unintentionally” exposed customer’s personal data online.

What is the reason for the data leakage?

According to an email the company is currently sending out, the security leak occurred due to an internal DigitalOcean document that was mistakenly left accessible online.

Digital Ocean says the document contained several types of user account details.

This included personally identifiable information such as customer email addresses and their respective Digital Ocean usernames, but also account technical details such as the number of droplets (servers) owned by the customer, the user’s bandwidth usage, support or sales communications notes, and the amount of money the customer paid during calendar year 2018.

Digital Ocean said that the internal document was accessed at least 15 times while it was left available online.

The web hosting provider said “it did not see any unauthorized access to impacted customers’ servers as a result of this incident. Our community is built on trust, so we are taking steps to make sure this doesn’t happen again”.

Digital Ocean said the file contained details for less than 1% of the company’s total customer base.

“We will be educating our employees on protecting customer data, establishing new procedures to alert us of potential exposures in a timelier manner, and making configuration changes to prevent future data exposure.”

 A copy of the email Digital Ocean has been sending customers today is available below.

To be noted:  

• This specific breach neither indicates the DigitalOcean website was compromised, nor the customers’ login credentials were leaked to the attackers.
• If you have an account with the hosting service, you don’t have to rush into changing your password.
• Service also offers two-factor authentication that every user must enable to add an extra layer of security to their accounts.

Less than 1% of the customer base was impacted, and the only PII (Personal Identifiable Information) included in the file was account name and email address.