HostDZire Says Ransomware Attack Encrypted VMware VPS Data, Forcing Rebuild
Summary
HostDZire says ransomware compromised most of its VMware infrastructure, encrypting virtual disks and permanently destroying data. The provider rebuilt nodes, restored VPS services in India and the Netherlands, and offered affected customers service-time compensation.
Key points
- HostDZire reported that multiple VMware ESXi hosts were compromised after customers reported inaccessible VPS services.
- All VMware nodes in India and some VMware nodes in the Netherlands and United States were affected; KVM nodes and Leaseweb VPS services were unaffected.
- The company said attackers encrypted virtual disks, permanently destroying data stored on affected nodes. Customers with external backups could restore services after replacement servers became available.
- HostDZire believes a recently disclosed VMware security vulnerability was the most likely cause, while its forensic investigation remains ongoing.
- The provider powered down affected nodes for containment, rebuilt the infrastructure, and reported completing replacement VPS provisioning in India and the Netherlands.
- HostDZire offered affected customers additional service time as compensation, varying by plan.
Article Details
- Victim Organization
- HostDZire
- Victim Domain
- hostdzire.com
- Incident Type
- Ransomware attack that encrypted virtual disks on VMware ESXi hosts
- Disclosure Date
- 2026-08-05
- Affected Data Size
- All data stored on affected nodes was reported permanently lost; the volume was not disclosed.
- Operational Impact
- Multiple VPS services became inaccessible. All VMware-based nodes in India and some VMware-based nodes in the Netherlands and United States were affected. HostDZire powered down affected nodes, rebuilt the infrastructure, and provisioned replacement VPS services. KVM nodes and Leaseweb VPS services were reported unaffected.
- Claim Status
- confirmed