Yeah I'm pretty sure the data loss is not a namecheap specific problem. Speaking from experience I lost an entire website (zero backups including app code - it was a horrible technical debt perfect storm situation no VCS etc) in the huge TigerMate inmotionhosting hack back in 2011 so this is nothing new. It was a PITA but the site was nothing special so I wrote it off as a valuable lesson.

If you give a shit about it, back it up.

We offer full backups with all managed servers/services

Self-managed a customer is responsible for their own backups. Just like with DO and that full server loss a couple of months back.

The key part of what he said there was "managed".

It's a $30 to $75 a month upcharge on top of the base VPS price. I don't think the OP was paying for a managed VPS.

Edit: Apparently, only the $75/month package includes backups. The $30/month package does not. (http://i.imgur.com/Iy7iacH.png)

This was a self-managed/unmanaged VPS, correct.

> We offer full backups with all managed servers/services

Are those backups purgeable from the account control panel?

Honestly I'm not a huge fan of same-provider backup solutions. It seems like asking a fox to guard your sheep.

No, they are offsite.

We who?

Example of on HN expecting everyone (newbies and all) to know who you are. This happens with DANG and SAMA comments as well. Back when PG used to comment also happened. Look at their profiles, really no explanation of who they are here:

https://news.ycombinator.com/user?id=pg

https://news.ycombinator.com/user?id=dang

https://news.ycombinator.com/user?id=sama

Why is it so hard to put info in your profile or to put a footnote in your comments for the newbies? Would you have your business act this way? Reply to a person's inquiry and not say who you are and what you do? Of course not.

He posted this down the thread which starts with:

> Disclaimer: I'm CIO @ Namecheap

https://news.ycombinator.com/item?id=11479810

Still not outrageous to think that people might be able to give rookies some context rather than check the full thread for other comments doing so.

given the context of the reply, any person of average intelligence should be able to figure it out (or just google)

Well I read the reply :

"we offer service X"

could be from anybody trying to say they offer the service, not obvious at all it is a representative of Namecheap

Matthew Russell is the VP of Hosting at Namecheap https://www.namecheap.com/about/team.aspx

What if any fault does Namecheap take with the breach and what is being done to resolve it?

See my other comments in this thread

I've reviewed all 16 of your comments on the page and beyond sawing a single person at Namecheap didn't follow policy and blaming the user in question, I don't see anywhere that you've stated there's an issue with controls.

Am I missing something, or is Namecheap saying they didn't do anything wrong?

You can't expect them to admit liability now can you? They offered the customer a year free of their shitty hosting without admitting fault after all.

I work for Namecheap

Second biggest lesson here: do not use weak passwords for emails.

Was interesting that the victim said they used 2FA for everything they considered important, but not email. I guess their email provider doesn't provide it?

I was thinking the same. But in that case, maybe move to a provider that does support it?

I don't see how that can be the biggest lesson. Someone at the service provider bypassed their own protocols in order to hand control of the system over to an unauthorized user. Even with local backups he would have needed to restore the servers because Namecheap royally screwed up.

Yes, you should always have more backups than you need. But wouldn't you be moving to a different provider after something like this anyway?

Yes, I would move. Impossible to do without the data, which is why it was the biggest takeaway to me.

Understood. I guess my point is that almost every data story can end with "should have had better backups" as the lesson.

I think another lesson in security is that 2FA are sometimes completely broken because of real use-case where the user lose his second authenticator device. This is one of the reason I'm really iffy about setting up 2FA on my own accounts.

By "off-host" do you mean physical VPS host or hosting company?

I think a better suggestion/wording (depending on your intent) re: backups would be "don't operate without independent backups".

Did you make it through to the part of the article where he says "my biggest personal lesson is to make off-host backups"? Not sure why you're making this post.

Which doesn't jive with the either the title, or conclusion of the post.