Security incident affecting an internal monitoring application

On 8 November 2026, we detected and contained a cybersecurity incident involving an internal monitoring application. The Control Panel and customer portals were taken offline briefly as a precaution and have been restored.

What happened

An external attacker exploited a vulnerability in the application to gain unauthorised access to internal systems and databases. The incident was a large-scale, AI-powered automated attack that used approximately 22,000 IP addresses.

The attacker used the application’s functionality to query internal databases, then broke out of the application’s Docker container to reach host-level information. This gave them access to application secrets and authentication credentials.

Actions taken

Following detection, we began containment and remediation:

1. The affected application and server were taken offline and isolated.
2. The attacker’s access was blocked, and the vulnerability was closed.
3. Attacker-created database objects were removed.
4. Signing keys and security keys on critical equipment were rotated.
5. Credentials identified as potentially at risk have been rotated or revoked.
6. Additional monitoring and security controls have been introduced.
7. The affected server is being rebuilt in a clean environment.

What this means for customers

We do not yet have any evidence indicating call detail record (CDR) data was accessed or leaked. We have found no evidence that any data was altered. We are continuing to assess the full extent of the incident and any potential exposure.

We have informed the UK Information Commissioner’s Office, Ofcom, and the NCSC. Affected customers will be notified directly by email. As a precaution, we recommend all customers enable two-factor authentication and treat unexpected messages about this incident with caution. ConnexCS will never ask for your password.

Ongoing work

Our investigation and hardening work continue. We are reviewing the affected systems, auditing our CI/CD pipeline and container registry, and preserving forensic evidence. We will update this page if there is a material change.

Questions

Contact support@connexcs.com. ConnexCS Security Team