Ubiquiti has asked its customers to change their password because of unauthorized access to some of their information technology systems hosted by a third-party cloud provider. They did not specify the cloud provider that hosts its databases, nor how the attackers managed to gain access to them.

The company explained in an online alert and notification sent directly to users that “We cannot be certain that user data has not been exposed. This data may include your name, email address, and the one-way encrypted password to your account (in technical terms, the passwords are hashed and salted). The data may also include your address and phone number if you have provided that to us”. The email alerts sent by the company contain direct links to the web portal (located at account.ui.com), but some users were understandably worried that the email may be a phishing attempt.

Ubiquiti made sure to point out that they “have no indication that there has been unauthorized activity with respect to any user’s account,” but nevertheless encouraged every user to change the password and enable two-factor authentication on their Ubiquiti accounts, and to change their password on any website where they use the same user ID or password.

It is still unknown whether the possible Ubiquiti data breach is related with the outage to the UniFi cloud management platform experienced on Sunday.

Despite many customers being unhappy with the fact that they are required to create an account through the company’s cloud service to activate Ubiquiti devices, their popularity is unquestionable: Ubiquiti claims that nearly 85 million of its devices “play a key role in creating networking infrastructure in over 200 countries and territories around the world.”

To change their passwords, customers should visit the web portal indipendently, log in, go to Settings and select the Security tab. There, they can change their password, set a session timeout value, and enable 2FA. Customers who have forgotten their password or aren’t sure whether they’ve set up an account in the first place can use the “Forgot password?” option, enter their email address and wait for the password reset email.