OrganisationRU

FirstVDS

Russian virtual server hosting provider.

FirstVDS has rented virtual private servers since 2002, making managed virtualisation the core of its Russian hosting business.

Last refreshed: 22 October 2026 · Appears in 1 active topic

Key Question

How can FirstVDS customers detect theft that left no trace inside their servers?

Timeline for FirstVDS

#15 17 Oct

Disclosed theft of customer data through its management layer

Cybersecurity: Threats and Defences: FirstVDS loses client data via VMmanager

View full timeline →

Follow Cybersecurity: Threats and Defences →

Background

FirstVDS is a Russian hosting provider focused on virtual private servers. It has rented virtual servers since 2002. Its service depends on a management layer that administers customer systems beneath their individual guest servers.

That structure makes the provider responsible for infrastructure customers cannot inspect solely from within their own servers. Management-layer access can therefore affect hosted customers even when their guest systems appear unchanged. This relationship between provider, virtualisation platform and customer server is central to understanding FirstVDS and the risks attached to its service.

Common Questions

What happened to FirstVDS in October 2026?

FirstVDS said attackers exploited VMmanager 6 on 17 October and copied data from some customers' virtual-server disks through the management layer.Source: FirstVDS

What data was stolen from FirstVDS customers?

FirstVDS listed passwords, SSH and API keys, cloud credentials, configuration files, command histories, Cryptocurrency wallets and user files.Source: FirstVDS

Why did the FirstVDS breach leave no server traces?

The attackers mounted customer disks read-only from the virtualisation management layer. Their program did not run inside or change the guest servers themselves.Source: FirstVDS

What should affected FirstVDS customers change?

FirstVDS told notified customers to revoke and replace passwords, SSH keys, API keys, tokens and Cryptocurrency wallets stored on affected servers.Source: FirstVDS

Source Material

Security incident involving a vulnerability in a VMmanager 6 build About FirstVDS VMmanager vulnerability: change access credentials urgently

How the World Sees Them

FirstVDS

There are no traces of the attack on the affected virtual servers

ESET

first documented case of Yggdrasil being abused in this way by a state-aligned threat actor

Cyber Security Agency of Singapore

Attackers are exploiting

Canadian Centre for Cyber Security

open-source reporting indicating that the vulnerability is being exploited in the wild

Ahold Delhaize (Frans Muller)

was caused by the malicious actions of others

ENISA

the manufacturer is not required to comply with the vulnerability handling obligations

CERT-FR (ANSSI)

probablement toujours en cours

ASOS

impersonating a trusted contact

Check Point

actively exploited on Spark Firewalls as of September 12, 2026

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.