ownCloud has issued an urgent security advisory urging users to enable Multi-Factor Authentication (MFA) following a credential theft incident reported by threat intelligence firm Hudson Rock.
The incident, discovered in January 2026, affected organizations using self-hosted file-sharing platforms, including some ownCloud Community Edition deployments.
What Happened
The incident did not result from any vulnerability or zero-day exploit in the ownCloud platform itself.
Instead, threat actors obtained user credentials through infostealer malware such as RedLine, Lumma, and Vidar installed on employee devices.
These stolen credentials were then leveraged to access ownCloud accounts that lacked Multi-Factor Authentication protection.
Hudson Rock’s report explicitly states: “These catastrophic security failures were not the result of zero-day exploits in the platform architecture.”
The attack chain was straightforward: compromised credentials plus disabled MFA equals unauthorized access.
ownCloud strongly advises all users to enable MFA on their instances without delay.
Multi-Factor Authentication provides a second verification layer that prevents unauthorised access even when passwords are compromised.
Essential protective steps include:
- Enable two-factor authentication on all user accounts using ownCloud’s built-in MFA capabilities
- Reset user passwords immediately and enforce strong, unique credentials
- Review access logs for suspicious login patterns or unauthorized account activity
- Invalidate active sessions to force users to re-authenticate with MFA enabled
This incident underscores a critical vulnerability in self-managed file-sharing deployments: security depends entirely on proper configuration and user compliance.
Organizations must recognize that platform tools alone provide insufficient protection without enforcement mechanisms.
For businesses requiring enterprise-grade security, ownCloud alternatives like Kiteworks offer hardened environments with MFA enforcement, network firewalls, and zero-trust architecture built-in by default eliminating configuration risks inherent to self-managed systems.
ownCloud users should prioritize MFA activation immediately. Organizations concerned about broader security posture should review their access controls, incident response procedures, and consider whether self-hosted solutions meet their security requirements.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
 following a credential theft incident reported by threat intelligence firm Hudson Rock.){kind=link}