Cybersecurity Firm Imperva Discloses Breach
Summary: Imperva alerted customers on Tuesday that a data breach exposed email addresses, hashed and salted passwords, API keys and customer-provided SSL certificates for a subset of its Incapsula cloud WAF customers who had accounts through September 15, 2017. Imperva said it learned of the exposure from a third party on August 20, 2019, and urged customers to change Incapsula passwords, enable multi-factor authentication, reset API keys and generate new SSL certificates.
What's compelling: DisruptOps founder Rich Mogull said an attacker holding those API keys and SSL certificates could whitelist their own traffic past the WAF, modify security settings, and potentially intercept, view, modify or divert a customer's site traffic - a worst-case scenario he ranked with the provider's worst nightmare.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026