Hostwinds says it found unauthorised access to the system that runs its client area and billing, took the client area offline and has since reset every client area password; client area back online on a newly built system
Web hosting provider Hostwinds said on its status page on 22 October 2026 (posted 14:44 UTC, 10:44 pm Perth) that it had 'identified unauthorized access to the system that runs the Hostwinds client area and billing', proactively took the client area offline as a precaution, is working with an independent forensic and cybersecurity firm, and has notified the appropriate law enforcement agencies.
Hostwinds said customer servers and websites remained online, but that as a precaution it had disabled access to potentially impacted services, so some customers might not be able to sign in to their server.
In an update posted on 24 October (18:11 UTC, 2:11 am Perth 25 Oct), Hostwinds said the client area is back online at clients.hostwinds.com, having reopened on the evening of 23 October on a newly built system; that as part of its response it has reset every client area password, so old passwords no longer work; that it has emailed customers with full details and steps to take; and that its investigation with an independent forensic firm is continuing.
Hostwinds said PayPal payments are temporarily unavailable while it reconnects them and that the affiliate portal (affiliates.hostwinds.com) remains offline.
Hostwinds has not said what data, if any, was accessed or how the attacker got in. Hostwinds warns that it will never ask for passwords, SSH keys or full card numbers by email, chat or phone, and that a password reset email only arrives after the customer selects 'Forgot password' themselves. Primary: Hostwinds status page; vendor guide: Hostwinds password-reset instructions (23 Oct).
- Product
- Hostwinds client area and billing system (web hosting provider)
- Versions
- n/a — hosting provider incident
- Exploited in Australia?
- unknown
- Patch to
- Hostwinds (24 Oct): set a new client area password by typing clients.hostwinds.com into the browser and selecting 'Forgot password' (don't use links in emails), use a unique password and turn on two-factor authentication, and remove unrecognised users under User Management. Change root and administrator passwords, SSH keys and control panel passwords directly on your server, not through the client area, then back up your data; leave the Hostwinds security key described in its email in place. Check for user accounts, keys, DNS records or account details you didn't change, and change any password you shared with Hostwinds in a support ticket. Report signs of access to support@hostwinds.com.