Issue on two of our Linux Hosting Servers

We have monitored the server and no new activity has been noticed.

If you are still seeing any such issues, please raise a ticket to the support team.

We have not received any new password change notifications or multiple hits from a Pakistani IP address in this time frame.

We are monitoring the servers for some more time.

What is it about?

We are seeing WHM password changes happening from Pakistani IP addresses the mentioned servers.

Who is affected?

As per the primary investigations, it is not a root level hack and customers who were using weak passwords got compromised. 

What needs to be done on the server to fix this?

We have blocked the IP addresses that were trying to hit the password API to change the passwords and gain access to data and we are continually doing that. However, please ensure to change the password for WHM as well as cPanel accounts to a strong one so that we can reduce the chances for the hacker to hit domains with weaker passwords.