name.com breach

Skinner · May 8, 2013

I just got this email, it seems genuine, the password reset link checks out, the headers all look ok.

I think some registrars could learn a lesson here, about openness and dealing with problems.

Dear <username removed>,

We are writing to inform you of a security measure we have taken to protect the integrity of the domain names and information associated with your account.

Name.com recently discovered a security breach where customer account information including usernames, email addresses, and encrypted passwords and encrypted credit card account information may have been accessed by unauthorized individuals. It appears that the security breach was motivated by an attempt to gain information on a single, large commercial account at Name.com.

Name.com stores your credit card information using strong encryption and the private keys required to access that information are stored physically in a separate remote location that was not compromised. Therefore, we don't believe that your credit card information was accessed in a usable format. Additionally, your EPP codes (required for domain transfers) were unaffected as they are also stored separately. We have no evidence to suggest that your data has been used for fraudulent activities.

As a response to these developments, and as a precautionary measure, we are requiring that all customers reset their passwords before logging in. If you use your previous Name.com password in other online systems, we also strongly recommend that you change your password in each of those systems as well.

Please click the link below to reset your password:<link removed>

We take this matter very seriously. We've already implemented additional security measures and will continue to work diligently to protect the safety and security of your personal information.

We sincerely apologize for the inconvenience. If you need any additional assistance or have any questions please email [email protected]. We'll continue to be as open and honest with you as possible as additional important information becomes available, so keep your eye out for a blog post or additional emails.

Thanks,
The Name.com Team

WealdDomains · May 8, 2013

Michael Berkens has also reported this at http://www.thedomains.com/2013/05/08/name-com-tells-customers-to-change-password-due-to-breach/ which suggests that it is likely to be genuine

retired_member33 · May 8, 2013

Name.com has always beeny registrar of choice for .com, .net etc....they are a breath of fresh air.... Great support, open, honest...can recommend them to.anyone and that is what i actually do if someone asks me if I know a reliable registrar.

Sorry for the short msg or any spelling mistakes, typing this on my phone.

StoneRoses · May 9, 2013

ProDomains said:
Name.com has always beeny registrar of choice for .com, .net etc....they are a breath of fresh air.... Great support, open, honest...can recommend them to.anyone and that is what i actually do if someone asks me if I know a reliable registrar.

Sorry for the short msg or any spelling mistakes, typing this on my phone.

Couldn't agree more,they are pretty much everything and more i want from a registrar.
how they handled this security breach is a great example of how they do things.

Best registrar by a country mile imo.

DaveP · May 9, 2013

As the above I use Name.com as much as I can for anything non uk related. They are fantastic! I sometimes use GoDaddy if I'm feeling cheap and want to reg a .com using one of their $1 coupons lol.