![](\"https:\/\/tctechcrunch2011.files.wordpress.com\/2015\/10\/shutterstock_1719293211.jpg?w=738\")
<\/p>\n<\/p>\n
OneLogin, a major access management service (think corporate-level password manager) alerted its users yesterday of \u201cunauthorized access\u201d to the data of its US-based users. That kind of thing isn\u2019t always<\/em> serious\u2026 but it turns out this one sure was. An update posted today reveals the hacker may have had very deep access indeed.<\/p>\n \u201cOur review has shown that a threat actor obtained access to a set of AWS keys\u2026Through the AWS API, the actor created several instances in our infrastructure to do reconnaissance,\u201d read the company blog post detailing the attack<\/a>.<\/p>\n \u201cThe threat actor was able to access database tables that contain information about users, apps, and various types of keys. While we encrypt certain sensitive data at rest, at this time we cannot rule out the possibility that the threat actor also obtained the ability to decrypt data.\u201d<\/p>\n An email reportedly sent to users<\/a> was more succinct:<\/p>\n All customers served by our US data center are affected; customer data was compromised, including the ability to decrypt encrypted data.<\/p>\n<\/blockquote>\n Wow! That\u2019s really<\/em> bad! That indicates that the hacker obtained a level of access that some services don\u2019t even create in the first place. End to end encryption and (nearly) zero knowledge systems exist to prevent this kind of hack in addition to the occasional National Security Letter.<\/p>\n Affected OneLogin users can visit this page<\/a> for a handy 11-step guide to securing your data, if that\u2019s possible, or read through it over at El Reg<\/a>.<\/p>\n Featured Image: Brian A Jackson<\/a>\/Shutterstock<\/a><\/small><\/p>\n","protected":false},"excerpt":{"rendered":"\n
![\"\"](\"https:\/\/tctechcrunch2011.files.wordpress.com\/2015\/10\/shutterstock_1719293211.jpg?w=680\")
OneLogin, a major access management service (think corporate-level password manager) alerted its users yesterday of “unauthorized access” to the data of its US-based users. That kind of thing isn’t always serious… but it turns out this one sure was. An update posted today reveals the hacker may have had very deep access indeed. Read More<\/a><\/p>\n\n<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>\n<\/div>\n
<\/p>\n","protected":false},"author":5817,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[25],"tags":[59,66,26],"class_list":["post-342555","post","type-post","status-publish","format-standard","hentry","category-technology","tag-media","tag-techcrunch","tag-technology"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/342555","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/users\/5817"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/comments?post=342555"}],"version-history":[{"count":0,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/342555\/revisions"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/media?parent=342555"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/categories?post=342555"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/tags?post=342555"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}