MongoHQ Security breach

Re:MongoHQ Security breach by mrkurt on Tuesday October 29, 2013 @07:56PM (#6638432)

We're very sorry about this, we went into a little bit of a panic when we realized that we held IAM credentials that gave full access to peoples' EC2 accounts and did what we thought was best. In hindsight, we should have gotten ahold of Amazon immediately and let them manage that process.

You should have a support issue open in your AWS portal now, if you need any help getting new keys for other apps. If you can't find it hit us up at [email protected] and we'll escalate.

[ Parent | on HN ]

Re:MongoHQ Security breach by thomasfromcdnjs on Tuesday October 29, 2013 @09:35PM (#6638871)

Our application also had problems due to this. Would have been nice to receive a phone call or email.

[ Parent | on HN ]

Re:MongoHQ Security breach by thomasfromcdnjs on Tuesday October 29, 2013 @10:00PM (#6638961)

Also I believe you should alert us as soon as you find out how long your servers have been compromised for.

As a company we are now trying to figure out how long our access tokens have been out in the wild.

[ Parent | on HN ]

Re:MongoHQ Security breach by mrkurt on Tuesday October 29, 2013 @10:58PM (#6639165)

You are 100% right on both points. We'll be updating our security page as we get more details, I expect we'll have some rough timeline information tomorrow.

[ Parent | on HN ]

Re:MongoHQ Security breach by sprice on Tuesday October 29, 2013 @08:23PM (#6638569)

Thanks. I appreciate being overly cautious when it comes to security rather than under cautious. And this has made us realize that we should have a unique profile for each service.

[ Parent | on HN ]