ownCloud Warns Users to Enable MFA After Credential Theft Reports
- Securityish
- Privacy & Personal Security
Quick Summary
ownCloud has alerted its over 200 million users to enable multi-factor authentication (MFA) following reports of credential theft attacks. The advisory comes after Israeli cybersecurity firm Hudson Rock revealed that multiple organizations, including those using ownCloud Community Edition, were breached due to compromised credentials obtained via infostealer malware like RedLine, Lumma, and Vidar. This incident highlights the importance of MFA in protecting user data from unauthorized access.
The Securityish Brief
ownCloud, a file-sharing platform with over 200 million users, issued a security advisory urging users to enable multi-factor authentication (MFA) to safeguard against credential theft attacks. This warning follows a report from Hudson Rock, published on January 5th, which detailed how threat actors exploited compromised credentials to access self-hosted file-sharing platforms, including instances of ownCloud Community Edition.
The report indicated that the attackers obtained user credentials through infostealer malware, specifically mentioning RedLine, Lumma, and Vidar, which infected employee devices. The ownCloud platform itself was not breached; rather, the incidents were a result of users logging in without MFA enabled, making them vulnerable to unauthorized access.
Organizations affected by these attacks include high-profile entities such as Deloitte, KPMG, Samsung, Honeywell, Walmart, and the U.S. CDC. The threat actor known as Zestix has also been linked to selling corporate data stolen from various companies, including those using ownCloud.
Why Enabling MFA is Crucial
Given the increasing sophistication of cyber threats, enabling MFA is essential for protecting sensitive data. MFA adds an extra layer of security, making it significantly harder for attackers to gain unauthorized access, even if they have stolen user credentials.
ownCloud recommends that users take immediate action by enabling MFA on their accounts, resetting all passwords, and reviewing access logs for any suspicious activity. These steps are vital to mitigate the risk of future attacks and to ensure the integrity of user data.
This incident serves as a reminder of the importance of robust cybersecurity practices, particularly for organizations that handle sensitive information. Users should remain vigilant and proactive in securing their accounts against potential threats.
Key Takeaways
- Enable multi-factor authentication (MFA) on your ownCloud account to enhance security.
- Reset all user passwords to prevent unauthorized access from compromised credentials.
- Invalidate all active sessions to ensure re-authentication is required.
- Review access logs for any suspicious login activity to identify potential breaches.
- Stay informed about the latest cybersecurity threats and best practices to protect your data.
Key Terms & Concepts
- Multi-Factor Authentication (MFA): MFA is a security measure that requires users to provide two or more verification factors to gain access to an account.
- Infostealer Malware: Infostealer malware is designed to steal sensitive information, such as login credentials, from infected devices.
- RedLine: RedLine is a type of infostealer malware that targets user credentials and personal information.
- Lumma: Lumma is another variant of infostealer malware known for stealing sensitive data from compromised devices.
- Vidar: Vidar is a form of infostealer malware that collects personal information and login credentials from infected systems.
Read the original article here: https://www.bleepingcomputer.com/news/security/owncloud-urges-users-to-enable-mfa-after-credential-theft-reports/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
