- Resetting all passwords and regenerating API keys (e.g., for Notion, SendGrid, Hetzner).
- Deactivating all user accounts, restricting access to a minimal number of administrators with mandatory two-factor authentication (2FA).
- Initiating a forensic investigation.
- Access the integrated automation platform (n8n).
- Retrieve an unrestricted API key for the internal Notion knowledge base, which contained infrastructure documentation and credentials.
- Use the compromised information to escalate access further and send emails from an internal account.
- Scope: The core Localmind platform was not compromised. The attack was confined to administrative interfaces and test environments. A limited number of customer systems were accessed, while on-premise instances showed no signs of unauthorized access.
- Forensics: Unauthorized logins were traced to IP addresses from VPN providers, complicating attribution. Login activity occurred outside regular business hours (nights, weekends). As of October 8, no evidence of large-scale data exfiltration was found.
- Data transparency: Localmind offered data exports to customers to conduct their own audits for potential GDPR breach notifications.
1. New infrastructure: A migration of virtual machines to new, Tier IV, ISO 27001/27018 certified data centers with a fully isolated infrastructure was nearly complete as of October 8. Systems are being rebuilt from clean data volumes (e.g., Docker volumes) onto new, hardened hosts.
2. Access security:
- Implementation of an F5 Web Application Firewall (WAF) with pre-authentication for each customer instance.
- Mandatory two-factor authentication (2FA) for all application logins.
- Deployment of the Wazuh security agent for centralized login monitoring and anomaly detection.
- All previous service accounts and credentials within automation workflows were deleted, requiring a re-issue.
3. Automation restriction: Critical automation nodes in n8n (e.g., Execute Command, Read/Write File to Disk) were disabled and will be unavailable in cloud environments going forward.
4. Enhanced monitoring: Additional security agents were deployed for endpoint security, configuration assessment, file integrity monitoring, and threat intelligence.
5. Process change: Each customer instance undergoes a manual audit and documentation before restart, with the audit protocol provided to the customer.