newsofehrmedia 🇬🇧

«If we don’t listen to what these voters are telling us on public safety, the economy, housing, quality of life etc then these votes are not coming back.
This would have dire consequences for Dems. We are even at risk of losing state-wide offices. This is a moment of truth.»

🔹OneLog currently believes this to be an act of sabotage. There is currently no indication that any personal data, including personal information or passwords, has been stolen.

🔹OneLog did not have any sensitive data such as credit card details or CV information. No data from the subscription or payment systems was replicated in OneLog's systems either. What OneLog manages is login data (with passwords stored as hash values with special protection), logs and, depending on the partner, additional data (in the minority) such as a date of birth recorded during registration or an address for participation in a competition.

🔹Against the background of ongoing investigations, OneLog has regularly provided information and carefully considered what information should be made public. This was - and still is - necessary in order not to provide the suspected perpetrators with valuable details from the investigation work or to provide free riders (e.g. for phishing attacks) with information. For this reason, for example, no detailed information can be provided on the encryption algorithm used for the data and passwords or on what conclusions can be drawn from the logs. The restoration of the OneLog service and the integrity of the investigation will always be our first priority.

🔹As has been the case since OneLog was founded, OneLog is now also in contact with the EDÖB (in addition to the law enforcement and other authorities).

🔹OneLog partners such as Blick, Handelszeitung and Beobachter have informed their users directly that the OneLog service is available again and what users need to do to set a new password. This has worked well so far. A direct e-mail to all persons registered with OneLog users was not sent, because such a mass e-mail would have led to a partial blocking of the sender's address and password resets would no longer have worked there. OneLog therefore decided not to do this.

🔹OneLog uses extensive security measures to ensure the protection of user data. These include modern methods such as data encryption, multi-factor authentication, regular backups and audit trails to ensure that all activities are logged in a traceable manner. There are also guidelines on password complexity and continuous monitoring, including audits by independent third parties.

🔹To further strengthen security, OneLog operates a BugBounty program that invites external security experts to identify and report potential vulnerabilities at an early stage.

🔹Despite these measures, there is always a residual risk in the digital world, as cyber threats and attack techniques are constantly evolving and no system is completely invulnerable. In the case of OneLog, an act of cyber sabotage is suspected, with the presumed aim of deliberately causing damage to the digital infrastructure that would affect the functionality of the login tool. Without going into detail here, the case does not fit the classic pattern of otherwise known ransomware attacks, according to the information available to date.