Hack Attack Takes Down Dark Web: 7,595 Websites Confirmed Deleted

The most prominent provider of free site hosting on the Dark Web has been taken down by hackers. Here’s what happened and why it matters.

The operator of the biggest free host for dark web sites, Daniel’s Hosting, has confirmed that the service has been shut down following a hack attack that deleted all 7,595 site databases.

According to German software developer and Daniel’s Hosting owner, Daniel Winzen, the hosting database server was attacked on March 10, and all the databases related to hosting were deleted by the hackers. In a now unavailable statement posted to the site, unavailable because the site has been closed but seen by myself beforehand, Winzen confirmed that a new database user with full admin permissions had been created. Still, he was unable to associate this with any account to dig deeper into how the hack happened. What Winzen was clear about, however, is that 7,595 user accounts relating to Dark Web sites were affected. Winzen said that anyone who was operating a Dark Web site hosted with him should “treat all data as leaked,” and change passwords at any other websites they might have if they used the same credentials.

No backups mean nearly 7,600 Dark Web sites vanished overnight

While you may well associate the Dark Web as being an entirely criminal domain, this couldn’t be further from the truth. Sure, there are dark web marketplaces that will sell you a $20,000 (£16,000) bank loan for $30 (£24) and hacker forums that are used to publish stolen data that has been exfiltrated during DoppelPaymer or Maze ransomware attacks. That’s before you even take the child pornography, drugs and weapon sales into consideration. But the Dark Web is much more than those criminal endeavors would have you believe; it is also an anonymous haven for whistleblowers, political activists and journalists. Daniel’s Hosting was home to many of the latter, with Winzen saying he spent a lot of time deleting illegal sites as he came across them. The service became the most significant free host on the Dark Web following the 2018 takedown of Freedom Hosting II by the Anonymous hacking collective after it claimed it found child abuse portals hosted there.

You might expect a web hosting site to maintain backups of such vital files. However, when talking about the Dark Web, things operate differently out of necessity. “Frustratingly, but by design, this service does not keep backups which could be disconcerting for those without a local backup,” Jake Moore, a cybersecurity specialist at ESET, says. “It goes without saying that these affected admins need to make sure their passwords were not being used for any other accounts as well,” Moore concludes.

The second Dark Web hack attack in less than two years

This wasn’t the first time that Daniel’s Hosting had been targeted successfully by hackers either. It was widely reported in November 2018, that the service had been hacked and at that time some 6,500 sites were taken down. The modus operandi would appear to be strikingly similar, with the hosting backend breached and hosting databases deleted.

The difference is that after the 2018 attack, Winzen rebuilt the service, and website operators returned in even higher numbers to use it. Initially, Winzen said he would be closing Daniel’s Hosting permanently following the most recent attack. “At this time, I do not plan on continuing the hosting project,” he said, even offering his project files for download by others who might wish to take up the free Dark Web hosting provider mantel. The day after the attack was discovered, March 11, Winzen apparently changed his mind and updated his original statement he said that “I may start another hosting project in the future, when I found time to improve the current platform.” Winzen did admit, however, that this could be several months down the line.