Beware!: Online billing service WHMCS victim of system hack

The Internet. Where would we be without this vast network of information? Well, probably nowhere. Many organizations have already gone digital or are on the verge of doing so when it comes to handling their invoices. However, we all know that the Internet is one to be handled with kid gloves.

Especially e-invoicing is a delicate subject, because a whole lot can go wrong when money and confidential information are involved. Let the hacking of WHMCS’s computer systems be a lesson: exposing credit card details of 500.000 customers on Twitter.

Hacking an online billing provider

How did the UndergroundNazis go about their attack?

• The group UGNazi (similar to Anonymous and The Unknowns) performed a social engineering attack.
• WHMCS founder and CEO Matthew Pugh writes on the company’s blog: “The person was able to impersonate myself with our web hosting company, and provide correct answers to their verification questions. And thereby gain access to our client account with the host, and ultimately change the email and then request a mailing of the access details.”
• With the details in hand UGNazi accessed WHMCS’s database and stole the 500.000 customers’ credit card details, passwords, user names and support tickets.
• After the “heist” the hackers deleted all files on the company’s servers, including 17 hours’ worth of new orders (ouch) and help tickets (ouch).
• Then they leaked the information on Pastebin, followed by a tweet.
• And then they put some icing on the cake when some other hackers started with a massive DDoS (Distributed Denial of Service) attack.

Again, these actions are reasons for concern. And this is not an isolated incident. It happened before, and before. The more e-billing, online billing and e-invoicing increase in adoption, the more billing service providers there will be. Most (let’s say 99%) claim to be “market leader,” but how can we be sure that they are up to standard security-wise? Quite an important aspect of electronic invoicing, right? This is the exact reason why we are 100% in favour of an international E-invoicing Trustmark.