Mittwald Cyber Attack Disables Client Websites
German web host Mittwald CM Service suffered a cyber attack in late October that compromised 56 customer projects and led to website shutdowns, ms-aktuell.de reported. The Espelkamp-based company discovered the unauthorized activity on November 4 after attackers exploited a vulnerability in an AI interface.
The breach stemmed from a security flaw in the provider’s MCP server, which allows customers to connect the mStudio platform with AI assistants. Mittwald stated that an attacker first tested the vulnerability on October 21 before executing the unauthorized system access on October 27.
Compromised Access and Forensic Investigations
The attackers extracted user session tokens from the vulnerable interface, granting them access to specific functions within existing logins. According to the company, regular passwords were not exposed, and all compromised tokens have since been completely revoked.
Internal specialists and external IT forensic experts investigated 56 compromised projects by November 6. Repeated checks revealed no additional affected projects or further attacker activity on the systems. Mittwald deactivated specific websites showing signs of unauthorized access as a precaution, leaving several blocks active in a status report published on November 7.
Mittwald restricted access and restored services after the incident
The security incident impacted clients beyond those with compromised websites. On November 5, Mittwald took precautionary steps by disabling mStudio logins, technical SSH access, and various extensions, which restricted orders and hosting modifications.
Mittwald restored mStudio logins and SSH access on Saturday, November 7, while keeping individual websites offline for security reasons. The company announced system restarts for November 6, resulting in temporary service interruptions lasting 10 to 15 minutes.
Required Client Security Measures
Mittwald is notifying affected customers directly by email with required security steps. Users of the compromised MCP interface must change their mStudio passwords, enable two-factor authentication, and check API keys and technical access permissions.
The company reported no evidence that stolen data has been published on internet platforms. Authorities including the police, the Federal Office for Information Security, and data protection supervisors have been notified of the incident.
Why the MCP server shut down and what was stolen
Why was the MCP server shut down?
Mittwald shut down the MCP server after discovering the security breach on November 4. The interface remains offline indefinitely while investigations continue.
Were regular customer passwords stolen?
The company confirmed that attackers only extracted session tokens rather than regular passwords. All compromised tokens were fully revoked following the discovery.
Which services remained operational during the incident?
Regular hosting services and email systems remained largely available throughout the incident. The separate customer center and its managed websites experienced no impact from the security breach.